security(attestation): refuse special evidence files without blocking on open #2303

Finding

The #2302 single-read repair correctly switched scientific-validation evidence intake to os.open(..., O_NOFOLLOW) followed by descriptor fstat, but the untrusted root member is opened with blocking O_RDONLY before its regular-file type is known. A FIFO named as the sole sealed evidence member can therefore block the verifier in open(2) indefinitely while it waits for a writer, so the intended non-regular fail-closed contract is not reached.

This is an availability/integrity boundary defect in the unsigned verifier foundation, not a psychometric-policy change.

RED / acceptance

1. Add a deterministic contract that intercepts the descriptor open and requires O_NONBLOCK together with O_NOFOLLOW before the untrusted member is opened. Do not use a test that can itself hang on a FIFO.
2. Minimal repair: add O_NONBLOCK to the leaf open flags; regular-file semantics are unchanged, while FIFOs/devices can be opened without a blocking wait and rejected immediately by the existing fstat regular-file check.
3. Preserve the one-byte-snapshot digest/parse binding from security(attestation): read sealed scientific evidence once before attestation #2302 and all security(attestation): isolate verifier outputs from sealed evidence and symlinked parents #2301 output safety.
4. Keep 100% owned branch/docstring coverage in Scientific Validation Evidence Quality.
5. Do not claim hosted GREEN until the repaired exact-head generation is terminal.

Refs #2299 #2300 #2301 #2302 #2164 ContextualWisdomLab/TEPP#637.