fix: harden updater preflight and restart diagnostics

[eWOOD29]

Scope

Hardens the v0.2.2 Beta updater after the live v0.2.0 → v0.2.1 incident. This draft PR does not modify Stable main, publish a Beta, or change the live installation.

Current remediation

• mixed/unsupported program roots fail before the helper startup handshake;
• updater/recovery restarts capture durable stdout/stderr diagnostics;
• restart diagnostics and update.log use a common alias-resistant append path;
• existing Windows log paths are opened without following the final reparse target and the returned handle is validated;
• POSIX existing/create paths use no-follow semantics where supported;
• behavioral regressions cover mixed/clean installs, the old-parent/new-helper handoff, status-120 diagnostics, hardlinks, create-collision alias replacement, and existing-file alias replacement.

Review history

Initial head 7729cc4ac8bb2d84680a0e6f10b64edac09bea66 failed independent review for a create-collision alias retry and insufficient behavioral coverage. Those findings were closed at 828805040ed2de9a4be384ffbe253f1f31a1968b.

The fresh re-review of 828805040ed2de9a4be384ffbe253f1f31a1968b found one remaining High issue: an already-existing diagnostic file could be replaced by an alias between validation and opening. That path was remediated, and the same protection was applied to ordinary update.log.

Intermediate CI 31747364301 exposed a Windows path-spelling false positive in an additional handle-path text comparison. That comparison was removed without weakening the no-follow open, handle reparse validation, post-open ancestor checks, or descriptor/path identity validation.

Frozen accepted candidate

• Head: ca9180839bae1b78c39884e5b72c9d53e66b33ca
• Head tree: 613aab26111971aa7010264ff265f27606416731
• Base: e6ddafd3ce6cbfffb8eb1403297fc8b27d0ed7e0
• Base tree: 11e29ebf025c042463c9d7492535d1d6f571c5cc
• Ancestry: 10 ahead / 0 behind; base is merge-base
• Changed files: exactly scripts/update_helper.py, tests/test_update_channels.py, tests/test_update_lock_alias_regression.py
• Exact-head CI: 31747621925 — SUCCESS
• Windows Python 3.11/3.13: 201 tests, zero skips
• Ubuntu Python 3.11/3.13: 201 tests with 13 existing platform skips
• portable install/build, package-byte comparison, private-fixture comparisons, JavaScript, compile, privacy, and docs: PASS

Independent second-remediation re-review

RESULT: PASS

The reviewer independently reproduced both the restart-diagnostic and runtime/update.log existing-file replacement attacks against the production open path. Both were rejected and both protected targets remained byte-for-byte unchanged. Windows no-follow/reparse-handle controls, POSIX O_NOFOLLOW, O_EXCL retry, hardlink controls, old-parent/new-helper behavior, mixed/clean installs, status-120 diagnostics, rollback/recovery, privacy, and the full three-file security/regression sweep passed with no remaining findings.

PR #5 remains intentionally draft and targets develop. The candidate has passed the required independent review; integration into develop now requires Ethan's separate explicit merge authorization. No Beta has been published and the live installation remains on Stable v0.2.1.