governance CLI output TOCTOU

Trap: one-time samefile()/resolved-path checks look sufficient because they reject stable direct, symlink, and hard-link aliases, but a mutable parent symlink can be retargeted before mkstemp() or os.replace(), overwriting an authenticated input or aliasing both outputs. Fix: bind and validate output parent directory descriptors through temporary creation and rename, then reject any changed path/inode identity before publication.