Findings from three /astra-review rounds on the previous commit:
- writeReport: write to an exclusively created 0600 temp file in the
destination directory and rename it into place. Removes the lstat/write
race, replaces (never follows) a pre-existing symlink, and tightens
permissions on an existing world-readable report. Full-write semantics via
writeFileSync on the descriptor; temp file removed on any failure.
- scope: normalize the git toplevel and cwd with path.resolve before
realpath (git reports forward slashes on Windows) and display file paths
git-style with forward slashes.
- tests: build fixture roots with path.resolve/path.join so containment
checks hold on Windows; skip POSIX permission and symlink assertions where
the platform cannot support them.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
