fix: harden fastRemoveDirectory against TOCTOU symlink attacks (#417)

[kexi]

Summary

Fixes #417 (Severity: High). Defends against Time-Of-Check / Time-Of-Use symlink-swap attacks in fastRemoveDirectory. Previously, an attacker with write access to a worktree's parent directory could replace the target between the existence check and the rename/trash invocation, redirecting the operation to an attacker-chosen location.

Defense-in-depth changes:

• Replace exists() with lstat()-based validateRemovalTarget; refuse symlinks and non-directories outright.
• Re-validate the leaf and immediate parent (lstat, not realPath string compare) immediately before each external sink: native trash adapter, AppleScript fallback, temp-dir rename, parent-dir rename.
• After each rename, re-lstat the destination; on TOCTOU detection, roll back and skip background deletion entirely.
• Harden moveToMacOSTrashViaAppleScript with leaf+parent lstat checks (Finder may follow leaf symlinks).
• Extend CONTROL_CHARS_PATTERN to cover U+2028 / U+2029 (AppleScript line terminators).
• Filter symlinks from cleanupStaleTrash readDir enumeration and re-lstat each candidate before spawning rm -rf.
• Bump trash-name UUID suffix from 8 to 16 hex chars (64 bits).
• Fix inverted JSDoc on RuntimeFS.lstat / stat; the security claim depends on lstat NOT following symlinks.

Behavior change for callers: fastRemoveDirectory now returns {success: false} for symlink / non-directory targets. The single production caller (removeWorktree in clean.ts) already falls back to git worktree remove on success: false, preserving graceful behavior for any legitimate path.

Test Plan

• Added 7 regression tests in fast-remove.test.ts:
  • rejects symlink to directory (sensitive target survives intact)
  • rejects symlink to file
  • rejects regular file
  • rejects broken symlink (not silently treated as not-found)
  • rejects when immediate parent is a symlink
  • succeeds when only a deeper ancestor is a symlink (regression guard for macOS /var → /private/var etc.)
  • cleanupStaleTrash skips .vibe-trash-* symlinks
• pnpm run check:all passes (lint + typecheck + 416/416 tests + docs Astro check + video typecheck)
• Independent code review and security audit performed; all CRITICAL/HIGH findings resolved with no new issues introduced.

Checklist

• Tests added/updated
• pnpm run check:all passes
• Docs updated (if needed) — N/A (no command/option changes; only internal security hardening)

Fixes #417