fix(cookbooks): keep downloads inside destDir through an os.Root

[tas50]

Summary

Cookbooks.DownloadFiles (and Download) checked each manifest path lexically, so ../x was refused. But it then trusted the filesystem it wrote into. A symlink already under destDir that pointed elsewhere carried the write with it: with recipes -> /elsewhere, the manifest's clean recipes/default.rb landed in /elsewhere/default.rb. A file that was itself a symlink out of destDir was read through for the "already up to date" check; when its target happened to match the checksum, the link was left in place instead of a real file.

A manifest cannot create symlinks, so this needs a pre-existing link in the destination (a shared or reused checkout, say). It's defense in depth rather than a remote exploit. os.Root (Go 1.24, with MkdirAll/Rename since 1.25) is the standard-library tool for exactly this.

Change

• Writes go through os.OpenRoot(destDir): the checksum read, MkdirAll, temp file and final rename are all held under destDir by the OS, not by string checks.
  • A symlinked directory pointing out of destDir fails the download, and nothing is written outside.
  • A symlinked file pointing out is no longer trusted as a cached copy. It's fetched and replaced by a real file; the link's target is untouched.
  • A symlink that stays inside destDir is followed as before.
• Manifest paths are checked up front with filepath.IsLocal (equivalent to the old filepath.Rel check, and it also refuses Windows reserved names). A bad manifest still fails before anything is fetched.
• The temp file's 0644 mode is set with File.Chmod on the open handle. Root.Chmod by name is documented as racy on Unix.
• destDir is created up front if missing (it was created implicitly before), and a destination that can't be created or opened fails before any fetch.
• The DownloadFiles doc comment states the new guarantee. No signature change.

Test plan

• New, red before the change: TestDownload_RefusesSymlinkedDirectoryOutOfDest (the file was written outside), TestDownload_ReplacesSymlinkedFileOutOfDest (an outside link was kept as a cached copy)
• New guards: TestDownload_FollowsSymlinkWithinDest, TestDownload_DestinationUnusable (destination is a file; destination can't be opened)
• Existing download tests unchanged and passing: traversal rejection, checksum mismatch and skip, truncated body leaves the destination intact, 0644 mode, filesystem failures with their error messages
• Every changed function at 100% line coverage; package 98.1% → 98.2%
• go test ./... -race -count=2, cd integration && go test ./... (HTTP and TLS cookbook round-trips), golangci-lint run ./... in both modules