Harden the primary log sink

[codeforester]

Summary

• make persistent-sink eligibility reflect the configured filesystem path
• keep log_is_enabled non-mutating while rejecting missing-parent,
  non-regular, symlink, non-owned, and unwritable targets
• create new primary logs privately and normalize new or existing files to
  mode 0600 before appending
• suppress best-effort setup and redirection failures, then disable a failed
  path for the remainder of the process
• apply the same sink contract to structured and file-content logging

Issue

Closes #192

Validation

• bats lib/bash/std/tests/lib_std.bats — 159 tests passed locally, with one
  environment-specific process-listing skip
• ./tests/validate.sh — 321 tests passed
• shellcheck --severity=warning lib/bash/std/lib_std.sh
• git diff --check

Notes

• This PR is stacked on Stop implicit argv logging #194; its base branch is
  security/191-20260725-safe-argv-logging.
• Successful terminal behavior and rendered log records are unchanged.
• log_is_enabled does not create or chmod a path; the final setup and append
  remain best-effort across filesystem races and I/O failures.
• Parent-directory creation, ACL removal, rotation, and new public sink APIs are
  out of scope.
• Run logging smoke tests on actual Bash 4.2 #193 will add an actual Bash 4.2 logging smoke test over the completed path.
• VERSION remains unchanged; this work is targeted to the v1.4.0
  milestone.

Checklist

• Branch name follows <category>/<issue>-<YYYYMMDD>-<slug>.
• Pull request is scoped to one issue, unless a documented multi-issue exception applies.
• Pull request body explains what changed and how it was validated.
• Relevant project checks pass.
• Documentation is updated when behavior or user-facing commands change.
• CHANGELOG is updated for notable user-visible or release-worthy changes.
• Pull request includes Fixes #<issue> or Closes #<issue> when merge should close the issue.