fix: tighten helper lookup, private fallback dir, and file locks

[undivisible]

Summary

Follow-up to the leftover items from the Praefectus maintenance cycle. Separate from #53 (orb setup / CI pin).

• Linux secure_command now matches macOS: /usr/bin, /usr/sbin, /bin, /sbin only. Rejects empty names, path separators, NULs, and does not follow symlinks.
• fallback_temp_dir uses 128-bit getrandom entropy, create_dir exclusive create, Unix mode 0700 at creation, and retries on collision.
• Replace unmaintained fs2 with fs4 1.1 (sync only). Ledger and Windows initialization locks call fs4::FileExt::{lock,unlock} by fully-qualified path to avoid std::fs::File::lock name collisions.

Does not change execute, authority, fencing, or CDP. Not auto-merging: locking + helper-path security.

Test plan

• cargo fmt --all -- --check
• cargo clippy --locked --all-targets --all-features -- -D warnings on 1.88 and stable
• cargo test --locked --all-features (171 tests, including new secure_command and fallback-dir privacy checks)

---

Note

Medium Risk
Changes helper executable resolution and cross-platform file locking used for the operations ledger and Windows init; misbehavior could break startup or weaken path trust, though scope is limited to locking and subprocess lookup—not execute/authority paths.

Overview
Hardens how Praefectus resolves helper binaries, creates its private state directory, and takes file locks.

secure_command on macOS and Linux now rejects empty names, path separators, and NULs; searches only /usr/bin, /usr/sbin, /bin, and /sbin (Linux no longer uses /usr/local/bin); and refuses symlink targets via symlink_metadata. Linux gains unit tests for injection and path allowlisting.

fallback_temp_dir no longer uses a one-shot hasher under the system temp dir. It loops on 128-bit getrandom names, creates the directory exclusively (retry on collision), and on Unix sets mode 0700 at creation; tests assert directory type, permissions, and name shape.

Locking dependency: unmaintained fs2 is replaced by fs4 1.1 (sync only). Ledger locks and Windows initialization locks call fs4::FileExt::lock / unlock with fully qualified paths. getrandom is added as a direct dependency; lockfile drops winapi pulled in by fs2.

^{Reviewed by Cursor Bugbot for commit 06592fa. Configure here.}

[capy-ai]

Capy couldn't review this pull request because Max's workspace is out of credits, add credits or enable auto-reload to resume automatic reviews.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_fb2d70eb-3b50-47c6-971a-967b78e23d21)