fix: eliminate TOCTOU race in yamlio.load_yaml()

[Quratulain-bilal]

Problem

yamlio.load_yaml() checks exists() then calls read_text(). The file can be deleted between the two calls, causing a raw FileNotFoundError instead of the clear BundlerError.

Fix

Remove the exists() pre-check and catch FileNotFoundError from read_text().

Testing

• Verified BundlerError is raised when file is missing

[Copilot]

Pull request overview

Eliminates the TOCTOU race when loading YAML files.

Changes:

• Converts FileNotFoundError into BundlerError.
• Removes the vulnerable existence pre-check.
• Missing a targeted regression test.

Show a summary per file

File	Description
src/specify_cli/bundler/lib/yamlio.py	Handles deletion during file reads.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[mnriem]

Thanks — has a test, appreciated. Please add the AI-disclosure per CONTRIBUTING. Bigger-picture: this is the same TOCTOU fix as #3908 (there it's RunState.load(), here yamlio.load_yaml()) — the identical exists()-then-read pattern at two call sites. Rather than one PR per call site, could you consolidate the TOCTOU/exists-precheck fixes into a single PR covering all the affected spots? It's far faster to review as one change, and with the disclosure added it'd move quicker. Same low-severity note as #3908 (this only changes which error surfaces in an extreme race), so it sits behind proven work — but consolidated + disclosed it's reviewable. Marking author-awaiting.