[Security][P0] Add handle-relative filesystem authority

[NWYLZW]

Closes #225. Relates to #224; PR #226.

Summary

Adds a typed filesystem-authority boundary and OS-local authenticated broker with generation-fenced claims. Publication is handle-relative and no-follow with exact no-overwrite semantics across macOS, Linux, and Windows; no visible pathname rollback is introduced. Package, desktop/server closure, and a four-platform CI matrix are included.

Reviewed local evidence at 174e886

• Authoritative source worktree: clean and exact at the reviewed head.
• Canonical source identity: 107 sorted path+NUL+bytes+NUL records; SHA-256 748513754952d9a6f91445775b0d80dce723447f0ef46e6cbf76b5da52f1519a.
• Independent final security and CI rereview: PASS.
• Real Chrome/CDP coarse-pointer runtime review: PASS.
• macOS arm64 clean native build and artifact parity: PASS.
• Local native security and protocol-mutation tests: 11/11 PASS.
• Server tests: 24/24 PASS.
• Source mutation checks: PASS.
• Utils tests: 15/15 PASS.
• Client transaction tests: 6/6 PASS.
• All six TypeScript scopes: PASS.
• Exact-scope dprint, lint, diff, YAML, and max-lines checks: PASS.
• Package closure: PASS.
• Packaged durable publish: PASS.

Screenshots

• issue225-terminal-visual-success-4fb3d122.png (local evidence SHA-256 84c7a0cca625c4948b65e7679c004fffcae77d5a24dbf5bcdf5c3af8847a703a; 420x760 full flow; UI bytes unchanged in 174e)
• issue225-terminal-coarse-runtime.png (local evidence SHA-256 7c559ea82ae21ec990618ef976dc72bc6ac363389efccd0214d3644298d7a244; genuine CDP coarse pointer; UI bytes unchanged in 174e)

gh CLI has no attachment upload and no URL is fabricated.

Remote validation pending new CI

UNRUN pending new CI and not claimed PASS:

• macOS x64 native matrix.
• Ubuntu x64 native matrix, including real nobody smoke.
• Windows x64 runtime, reparse, SID, FlushFileBuffers, and final-attribute tests.
• Four-platform closure.

Experience Review

• 已判断是否需要沉淀经验
• 如需要，已运行 $post-task-experience-review
• reviewer PASS 后才进入 merge

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
oneworks-dev	Ignored	Preview	Aug 3, 2026 5:52am

[github-actions]

Experience Review

Before merge, make sure the PR body contains this completed checklist:

## Experience Review
- [x] 已判断是否需要沉淀经验
- [x] 如需要，已运行 `$post-task-experience-review`
- [x] reviewer PASS 后才进入 merge

Checklist to confirm:

• Decide whether this PR produced reusable project experience.
• If experience should be captured, run $post-task-experience-review.
• Merge only after the independent reviewer reports PASS.