prepare-data-dir leaves files with a second name to their owner (closes #143)

A hard link in /data shares its owner with a file that can be anywhere
on the same filesystem, so chowning it gave that file to the netwatch
user. A regular file with more than one name now keeps its owner and
its path is logged.

Owners are now set on the opened directory or file after checking it,
as chmodDir sets modes, so a hard link swapped in afterwards is caught.
Symbolic links and other files that are neither directories nor
regular files are no longer given away: they cannot be opened safely,
and setting their owner by name could reach a hard link swapped in.

Model: opus-5-5

TODO.md

@@ -21,6 +21,16 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-18: `netwatch-server prepare-data-dir` no longer changes the owner of
+  a file outside `/data` through a hard link in the volume
+  ([#143](https://git.eeqj.de/sneak/netwatch/issues/143)). A regular file with a
+  second name (hard link) keeps its owner, and the start logs its path. Owners
+  are now set on the opened directory or file, never by name, so a hard link
+  swapped in after the check is caught too; symbolic links and other files that
+  are neither directories nor regular files keep their owner, as setting it by
+  name could reach a hard link swapped in at that name. The test that runs as
+  root hard-links a file from outside the volume into it and finds its owner
+  unchanged
 - 2026-10-14: stopping the server waits for a report file write already under
   way, the periodic flush's or the one `Append` starts when 10 MiB are waiting,
   before the final flush