prepare-data-dir leaves files with a second name to their owner (closes #143)

A hard link in /data shares its owner with a file that can be anywhere
on the same filesystem, so chowning it gave that file to the netwatch
user. A regular file or symbolic link with more than one name now
keeps its owner and its path is logged.

Owners are now set on the opened directory, file or link after
checking it, as chmodDir sets modes, so a hard link swapped in
afterwards is caught. A symbolic link is opened without following it
and given to the netwatch user itself. Setting the owner on an open
file or link needs Linux, the image's system; elsewhere it returns an
error. Other files, such as devices, keep their owner.

Model: opus-5-5

TODO.md

@@ -21,6 +21,20 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-18: `netwatch-server prepare-data-dir` no longer changes the owner of
+  a file outside `/data` through a hard link in the volume
+  ([#143](https://git.eeqj.de/sneak/netwatch/issues/143)). A regular file or
+  symbolic link with a second name (hard link) keeps its owner, and the start
+  logs its path. Owners are now set on the opened directory, file or link, never
+  by name, so a hard link swapped in after the check is caught too; a symbolic
+  link is opened without following it and given to the netwatch user itself, so
+  the server can still follow one in a sticky directory that anyone can write
+  to. Other files that are neither directories, regular files nor symbolic links
+  keep their owner. Setting the owner on an open file or link needs Linux, the
+  system of the image; on any other system the package still builds, and
+  `prepare-data-dir` fails at the first regular file or symbolic link. The test
+  that runs as root hard-links a file from outside the volume into it and finds
+  its owner unchanged
 - 2026-10-18: after an interval change, the summary's Reachable slot reads
   `--/--` in white, as at page load, until the second round since the change
   ends ([#140](https://git.eeqj.de/sneak/netwatch/issues/140)). It used to read