fix(security): close file-system-race (TOCTOU) sites in shared lib

[avifenesh]

Summary

Resolves the CodeQL js/file-system-race (high) alerts in the shared collector/analyzer code. These are check-then-use patterns where a separate fs.stat/fs.existsSync/fs.accessSync/fs.lstat on a path precedes a readFileSync/writeFileSync on the same path. Because this lib/ syncs to consumer plugins (deslop, repo-intel, + 11 others via sync.yml), fixing it here clears the alerts in those repos after the next sync + scan.

Changes

• New lib/utils/fs-safe.js readFileWithLimit() - opens the path once and runs the is-file check, size cap, and read against the same fd. A swap of the path between calls cannot redirect the read.
• collectors/codebase.js, enhance/suppression.js, enhance/cross-file-analyzer.js - replace stat/exists/access-then-readFileSync with readFileWithLimit (drops the redundant pre-check; missing/oversize throws and is handled by the existing catch).
• patterns/slop-analyzers.js - inline fd-based fstat+read using the injected fs so mocked tests keep working.
• enhance/auto-suppression.js - drop existsSync pre-check; read via fd, write via writeJsonAtomic.
• enhance/docs-analyzer.js, enhance/prompt-analyzer.js - back up from the in-memory original snapshot instead of re-reading the file immediately before the write (removes the read->write race).
• enhance/fixer.js - write via writeFileAtomic (temp + rename; rename never follows a symlink) while keeping the explicit assertNotSymlink refusal.

Test plan

• node --test -> 69 pass / 0 fail / 2 skipped (incl. fixer.test.js)
• All changed modules require() cleanly; readFileWithLimit verified for normal read, EFBIG (oversize), and ENOENT (missing)

[gemini-code-assist]

Code Review

This pull request introduces safe file-reading and atomic-writing mechanisms, specifically adding readFileWithLimit to mitigate TOCTOU (Time-of-Check to Time-of-Use) vulnerabilities and symlink-following attacks across multiple analyzer modules. While these security enhancements are applied successfully in several areas, the review feedback correctly identifies that lib/enhance/docs-analyzer.js and lib/enhance/prompt-analyzer.js still utilize fs.writeFileSync directly for writing files and backups. To fully secure the application against symlink redirection, these files should be updated to use the newly introduced writeFileAtomic utility.