[cppla]

Summary

Two independently reproduced correctness fixes:

• Certificate generation now compares actual parent-directory identities before writing. Relative/absolute paths and symlinked-parent paths naming the same output are rejected without creating or overwriting it. Case-only filenames in one directory are conservatively rejected for portability; distinct destinations retain secure permissions and matching-pair replacement behavior. The README explains the output-path requirement. This is not a claim to solve every filesystem naming rule or hostile concurrent directory replacement.
• SOCKS connections bind their owner context before authentication, then retain it through TCP setup and relay. Forced shutdown now cancels a context-aware custom authenticator instead of leaving it waiting until the handshake timeout. Authentication and dial timeouts remain child contexts; their successful cleanup does not cancel the established relay. UDP control ownership is unchanged.

Regression evidence

• Before the certificate fix, all four relative/absolute and symlink-parent cases (new/existing destinations) failed: the function returned success and created or overwrote the shared destination. All pass after the fix; added case-only rejection and distinct-directory matching-pair controls also pass.
• Before the SOCKS fix, forced shutdown closed the client and removed the tracked connection but left the authentication context and actual handler live. The test synchronizes accepted/entered events, forces shutdown with a pre-canceled context, and separately joins the real handler before independent cleanup. It now passes without sleeps or timeout-based success assumptions.
• Targeted regression race tests passed on Go 1.26.8.
• Full Go 1.26.8 make check passed, including all Go packages and 51 release-tool tests.
• Full Go 1.27.1 make race passed when run alone. Its first run overlapped the other full suite and failed in an existing fallback fixture before execution with UDP EADDRINUSE on its TCP-selected port. The serial rerun changed no code or assertions; that first setup failure is retained here rather than counted as a pass.
• Independent code review found no blocking issues; GitHub checks must pass before merge.

No Docker deployment, remote-machine changes, release publication, or comparative traffic experiment is included.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.