os: make recursive directory deletion symlink-race safe

[davidgmbb]

Summary

• replace the POSIX path-based delete worklist with an explicit descriptor-relative DFS
• retain each parent DIR * until its child has been removed, open child directories with openat(..., O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC), enumerate with fdopendir, inspect with fstatat(..., AT_SYMLINK_NOFOLLOW), and remove with unlinkat
• verify the opened and still-named directory identities before descent/removal, while preserving missing-path idempotence and the non-recursive deep-tree contract
• leave the Windows implementation and its reparse-point handling unchanged
• add a bounded POSIX stress regression that repeatedly swaps a child directory with a symlink to an outside directory and verifies the outside sentinel survives

Security invariant

After the root parent is opened, every descendant operation uses a single entry name relative to a retained directory descriptor. Directory opens refuse final-component links, and removals never follow links. A concurrent replacement can make deletion report failure or leave work for a retry, but it cannot redirect traversal into the symlink target.

openat2 is not required for this portable single-component walk: the retained descriptor plus O_NOFOLLOW/AT_SYMLINK_NOFOLLOW/unlinkat combination enforces the containment boundary on both Linux and Darwin.

Validation

• main 734f1d4597fb705b1643da1280b84283c1485ead is integrated at edb5cd81a1badd7087b7a14a767bda68ad3e6497
• all 55 retirement-contract, 23 materializer, and 15 rebinding tests passed locally
• materializer and contract self-tests passed
• complete pinned-file closure rematerialized; rebinding check reports current and a second refresh leaves all binding files unchanged
• GCC syntax checks passed for the combined os.c and os_test.c
• git diff --check passed
• fresh full CI and the new rebinding workflow are queued/running on this head; their completion is still required for full merge readiness

Fixes #95.

Latest integration

Preserves the descriptor-relative deletion implementation together with main's transactional resource-failure handling from #787. Source and test changes merged cleanly. The four retirement-binding file conflicts were resolved using identities rebuilt from the combined source tree.

The new #804 rebinding parser rejected this repository's valid project-only descriptor because it required a resources section. This integration makes that section optional, consistent with the existing materializer, without adding or changing resource records. A regression covers read-only checking, refresh, retained omission, and repeat-refresh idempotence. Existing pinned-input rejection checks remain in place.

This is a history-preserving merge update. The available GitHub connection does not support the lease-protected force-push required to publish a history-rewriting rebase.