fix(runtime): secure file writes through symlinked parents

[phall1]

Summary

• permit file writes through an existing symlinked parent directory
• keep the final destination component non-following and reject directory-like targets
• perform atomic replacement relative to an opened parent handle to narrow path substitution races
• cover symlink parents, final-component attacks, and destination types in storage-tier tests

The branch is rebased onto current main. The implementation and storage-tier tests were independently reviewed before publication.

[vercel]

Someone is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.