fix(runtime): secure symlink-safe file writes

[phall1]

Problem

Raw file-effect writes created parent directories before opening the destination. On macOS, an existing symlinked parent can be rejected by no-follow path creation; more importantly, resolving a path and later reopening it by name loses descriptor-bound identity.

Fix

Forward-port the previously reviewed symlink-safe implementation onto the current Cockpit SDK lineage:

• authorize while preserving the final component
• retain and write relative to the verified opened parent
• atomically stage/sync/replace regular files and final symlinks
• write FIFOs and other special files only through the exact no-follow-opened handle
• reject trailing separator destinations
• preserve confinement, cancellation, and cross-platform behavior

Evidence

• implementation is textually identical to the final reviewed ccd3ff2/e577c644/584ffb64 sequence; test blob matches 584ffb6
• root SDK suite compiled and ran all new tests: 3349/3366 passed; only the same three unrelated timing-sensitive teardown tests failed under machine load
• independent security review approved descriptor authority, symlink/final-component behavior, atomicity, handle cleanup, and Windows/POSIX semantics