fix(security): eliminate file-system races

[ty-everett]

Program linkage

Advances the security-extended follow-up in #324.

Summary

• resolve all seven open CodeQL js/file-system-race findings ([codex] Implement BRC-136 BASM overlay sync #170–build(deps): bump pnpm/action-setup from 6.0.5 to 6.0.8 #176)
• replace check-then-read and check-then-write flows with direct reads, exclusive creation, or same-directory atomic replacement
• use Dirent inspection instead of separate directory-entry stat checks
• add reusable, failure-tested file helpers for repository tooling and create-bsv-app
• make repository health CI execute every scripts/*.test.mjs control test so these guarantees persist

Affected paths

• docs manifest generation
• create-bsv-app file generation and package dependency merging
• wallet-toolbox version synchronization
• root workspace/infra version synchronization
• service edge/rate-limit policy synchronizers

Security and compatibility

Atomic writers use unpredictable exclusive temporary files, fsync, close, and rename, with descriptor and temporary-file cleanup on failure. Missing-file handling is based on ENOENT; unrelated read/write errors remain visible.

This PR does not change runtime APIs, routing, service access, CORS, CSP, origin or credential behavior, rate limits, or edge-policy contents. The public arbitrary-origin compatibility invariant remains unchanged. Generated docs manifest and synchronized service-policy outputs are byte-for-byte unchanged.

Verification

• pnpm health:check — 12/12 repository-control tests; 37 projects; 30 public packages; 242 findings; 6 active exceptions; 0 control errors
• pnpm --filter create-bsv-app lint
• pnpm --filter create-bsv-app build
• pnpm --filter create-bsv-app test:coverage — 35 suites / 243 tests; new file helper 100% statement/branch/function/line coverage
• pnpm --filter @bsv/wallet-toolbox build
• node --check packages/wallet/wallet-toolbox/syncVersions.js
• node scripts/sync-versions.mjs --dry-run — 35 packages, 0 workspace or infra changes
• pnpm check-versions
• node scripts/check-sdk-peer.mjs — 33 manifests, 0 violations
• pnpm --filter docs-site validate — 93 frontmatter files and links valid
• docs manifest generation — 93 pages, unchanged output
• service edge/rate-limit synchronization checks — clean
• pnpm audit --audit-level=low — no known vulnerabilities
• git diff --check

Release impact

No package is published by this PR. Proposed accumulated candidates remain @bsv/wallet-toolbox@2.4.5; this wave adds create-bsv-app@1.0.3. Root/docs tooling has no npm release. Final package versions will be reconciled before the publication wave.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ty-everett]

Final verification is complete at feaad63a172a34b7c06e6b8e38ec06066b60af1e.

• all 38 reported checks passed, including every infrastructure lane, coverage aggregate, Codecov patch, CodeQL, Sonar, Dependency Review, Socket, Node 24, and merge gate;
• direct CodeQL PR query: 0 open alerts;
• direct Sonar PR queries: 0 open/confirmed issues and 0 hotspots to review;
• review state: 0 unresolved threads and 0 requested reviewers;
• synchronized edge/rate-limit policy content and docs manifest remain unchanged;
• no public API, CORS, CSP, origin, credential, route, rate-limit, or access-policy behavior changed;
• no npm publication occurred.

GitHub reports only REVIEW_REQUIRED; the author account cannot self-approve. Per repository policy and #324, this is ready for the authorized administrator merge path.