feat: harden filesystem edits and release controls

[cervantesh]

Summary

• harden cross-platform file classification and atomic replacement semantics
• enforce coverage, packaging, release, security, and recovery checks
• add Node/OS CI matrix, CodeQL, Dependabot, and documented branch controls

Frozen issues

Closes #18
Closes #19
Closes #20
Closes #21
Closes #22
Closes #23
Closes #24

Repository settings required by #22 and #23 will be applied and verified after merge.

Validation

• npm ci, build, check, test, coverage, benchmark, audit
• package verification and npm pack dry run
• actionlint and YAML parsing

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 922abb61f5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Gate releases on commits contained in main

In .github/workflows/release.yml, this job is triggered by any pushed v* tag and reaches gh release create without verifying that GITHUB_SHA is an ancestor of origin/main. If someone with tag-push rights tags an unmerged branch or local commit whose package version matches the tag, the workflow will still publish a GitHub release, bypassing the documented reviewed-main release path; add an explicit fetch/merge-base --is-ancestor check before creating the release.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Avoid following symlinks after the lstat check

When the parent directory can be modified concurrently, this lstat-then-open-by-path sequence still has a symlink race: an entry that was a regular file at lstat can be swapped for a symlink before the later fsOpen(filePath, 'r'), and read() will expose the symlink target despite the new symlink rejection guarantee. Use no-follow open semantics or validate the opened handle against the lstat result before decoding content.

Useful? React with 👍 / 👎.