Refuse fetch writes through a symlink in the destination (closes #86)

sanitizePath checks manifest paths only as text, so a symlink already
inside the destination directory could send fetch's writes outside it.
checkNoSymlinks now looks at each existing part of a path with os.Lstat
and refuses the path if any part is a symlink, wherever it points.
fetch runs it immediately before each write: creating the parent
directories, creating the temp file, and renaming it into place. The new
test puts such a symlink at each of those three places, and once inside
a plain directory, and checks that the fetch fails and nothing outside
changes. The G304 comment now states what holds. A symlink swapped in
between a check and its write is not caught; os.Root closes that once
the Go version is raised.

Model: opus-5-5

internal/cli/fetch_test.go

@@ -475,7 +475,7 @@ func TestFetchRefusesSymlinks(t *testing.T) {
 			outside := t.TempDir()
 
 			chdirTemp(t)
-			require.NoError(t, os.MkdirAll(filepath.Dir(tt.link), 0o755))
+			require.NoError(t, os.MkdirAll(filepath.Dir(tt.link), 0o750))
 			require.NoError(t, os.Symlink(filepath.Join(outside, tt.target), tt.link))
 
 			opts := testOpts([]string{testApp, "fetch", "-q", server.URL}, afero.NewOsFs())