fix(fetchkit): harden local file saver symlink handling

[chaliy]

What

Harden LocalFileSaver so base_dir saves cannot escape through symlinked parent directories or final symlink targets. Update safety tests and specs/threat model for the mitigated behavior.

Why

LocalFileSaver previously depended on lexical path checks plus check-then-write behavior. In embeddings that expose save_to_file with a filesystem-backed base directory, symlinks could redirect writes outside the intended sandbox.

How

Use Unix directory file descriptors with no-follow opens for save-time traversal and final file creation. Keep the existing non-Unix fallback checks, add final-symlink regression coverage, and document the mitigation.

Risk

• Low / Medium / High: Medium
• What can break: Unix save_to_file now rejects symlinked paths that may previously have worked. Intended behavior for sandboxed LocalFileSaver usage.

Checklist

• Tests added or updated
• Backward compatibility considered
• Specs are up to date and not in conflict
• Documentation updated where behavior is specified