fix(herdr): secure presentation lock directories

[kirkins]

Intent

Herdr presentation locks use a shared local directory. A setgid temporary parent can leave an owner-only namespace at mode 2700, which the previous exact-0700 check rejected. This PR gives the lock namespace a portable private-directory check: it normalizes safe directories to 0700 and refuses replaceable parents, symlinks, and pre-existing open directories.

What Changed

• Added a portable directory-permissions helper that checks parent safety, refuses symlinked or open namespace directories, and normalizes private directories to mode 0700.
• Updated Herdr presentation lock handling to choose a stable namespace parent and secure the lock directory through the shared helper.
• Added behavior tests for safe creation and normalization, unsafe parent and directory refusals, symlinks, and fallback parent selection.

Risk Assessment

✅ Low: The focused change normalizes private lock directories and fails closed on unsafe directory states, with behavioral tests covering the safe and refusal paths.

Testing

Ran the focused directory-permission and Herdr backend behavior suites, then exercised setgid normalization and unsafe-parent, open-directory, and symlink refusals through the real adapter against an isolated Herdr session; all scenarios passed and the session and worktree fixtures were cleaned up. The host did not reproduce setgid inheritance from a parent, so the live normalization case started with a private directory explicitly set to 2700.

• Live validation: ✅ go - 3 of 3 scenarios driven live against the product

Scenario	Result	Live	Evidence
A private setgid lock directory is normalized to mode 0700 when resolving a live Herdr session lock.	✅ pass	live	Live Herdr lock-path assertions; herdr-lock-live.log
Resolving a lock beneath a replaceable parent refuses before creating the namespace.	✅ pass	live	Live Herdr lock-path assertions; herdr-lock-live.log
Resolving a lock with an existing open directory or symlinked namespace refuses; the open directory remains unchanged.	✅ pass	live	Live Herdr lock-path assertions; herdr-lock-live.log

Evidence: Live Herdr lock-path behavior

Source: Live Herdr lock-path behavior

PASS live Herdr fm-lab-lockguardproof-91946-1943: private setgid namespace normalized to 0700; lock=~/.no-mistakes/worktrees/9c758a282133/01M3F6AMJCAWDGE5BYCSHMXRC8/.tmp-herdr-lock-live/namespace/order-ccf4a74cf40cdcc1b729098e75aba426.lock
PASS live Herdr fm-lab-lockguardproof-91946-1943: replaceable parent refused before creation
PASS live Herdr fm-lab-lockguardproof-91946-1943: existing open namespace refused unchanged
PASS live Herdr fm-lab-lockguardproof-91946-1943: symlinked namespace refused

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• Live validation: ✅ go - 3 of 3 scenarios driven live against the product

Scenario	Result	Live	Evidence
A private setgid lock directory is normalized to mode 0700 when resolving a live Herdr session lock.	✅ pass	live	Live Herdr lock-path assertions; herdr-lock-live.log
Resolving a lock beneath a replaceable parent refuses before creating the namespace.	✅ pass	live	Live Herdr lock-path assertions; herdr-lock-live.log
Resolving a lock with an existing open directory or symlinked namespace refuses; the open directory remains unchanged.	✅ pass	live	Live Herdr lock-path assertions; herdr-lock-live.log

• tests/fm-dir-perms.test.sh
• tests/fm-backend-herdr.test.sh
• bin/fm-herdr-lab.sh provision fm-lab-lockguardproof-91946-1943
• bin/fm-herdr-lab.sh run fm-lab-lockguardproof-91946-1943 session list --json
• Live fm_backend_herdr_presentation_session_lock_path assertions against the lab session, followed by bin/fm-herdr-lab.sh teardown fm-lab-lockguardproof-91946-1943

✅ **Document** - passed

✅ No issues found.

🔧 **Lint** - 1 issue found → no changes applied ✅

• ⚠️ linter found issues (exit code 1)

🔧 No changes applied.
✅ Re-checked - no issues remain.

✅ **Push** - passed

✅ No issues found.