SandboxRootPolicy.resolve validated a path once (realpath), then
FileAccessCore.read_window/write opened it with a plain open(resolved, ...).
Because resolution and open() are two separate filesystem operations, an
attacker with write access to a directory the path passes through could
swap a component - the final one or an intermediate parent - for a symlink
after validation but before the open, which open() would silently follow
(CWE-367). The same gap existed on the unconfined path the built-in tools
use, which never resolved at all before opening.

Adds SymlinkSafeOpener, which opens the target one path component at a time
from the filesystem root, with O_NOFOLLOW set on every os.open() call
(O_DIRECTORY for all but the last component). Because O_NOFOLLOW only
inspects the trailing component of a single open() call, walking one
component per call means every component - not only the final one - is
independently re-verified not to be a symlink at the exact moment it is
opened. FileAccessCore.read_window/write (and the write helpers
prepare_append_content/handle_insert_position) now route every open through
this opener, restoring a resolve step for the previously-unresolved
unconfined path too, so the fix applies identically to the built-in
file_read/file_write tools and the inline read_file/write_file helpers. A
detected post-validation swap surfaces as ValueError for a confined caller
(same vocabulary as an ordinary containment violation) and as the
underlying OSError for an unconfined caller, matching what the built-in
tools already handle. Legitimate in-root reads and writes, including all
file_write modes (w/a/insert), are unchanged.

This is enforcement-only hardening - the set of paths admitted or rejected
is unchanged, so no Actor Configuration Standard revision is needed.
Documented as ADR-2035 D-9 (2026-08-08 revision, see its Revision History).

Tests: Behave scenarios simulate the exact race deterministically via a
monkeypatched resolve/realpath step for final- and intermediate-component
swaps across read and every write mode. Robot integration tests race real
concurrent threads (no mocks) against both the inline read_file helper and
FileAccessCore directly for every write mode, and against the built-in
tools' generic OSError handling.

ISSUES CLOSED: #105

@@ -0,0 +54,4 @@
+    Then the core raises ValueError mentioning "sandbox root"
+    And the secret outside the sandbox is never read
+
+  Scenario Outline: FileAccessCore.write refuses a final-component swap that happens inside its own resolve-then-open step for every write mode

@@ -0,0 +76,4 @@
+    Then the core raises an OSError
+    And the secret outside the sandbox is never read
+
+  Scenario: Legitimate in-root writes still succeed for every write mode after the hardening

@@ -80,0 +112,4 @@
+        target_path = self._sandbox / self._target_name
+        stop = threading.Event()
+
+        def swap_forever() -> None:

@@ -48,0 +59,4 @@
+# errno values a component-wise O_NOFOLLOW walk raises when a path component
+# no longer matches what it was when the caller resolved/admitted the path —
+# most commonly because it was swapped for a symlink after that decision.
+_SYMLINK_SWAP_ERRNOS = (errno.ELOOP, errno.ENOTDIR)

@@ -227,2 +328,4 @@
         return self._root_policy
 
+    @staticmethod
+    def _secure_open(