Harden native session reads against symlink and TOCTOU replacement #364

Summary

Harden native session file reads so that agent.usage and agent.transcript cannot follow a symlink or a path replacement outside the bound project directory after lexical path validation.

Rationale

The current flow validates a derived path and later opens that path in usage::read_window. A filesystem change between validation and opening can cause the reader to access a different target. The reader must bind validation, metadata inspection, and content reading to one opened file handle.

Affected areas

• src/agent/usage.rs: usage::read_window
• src/agent/transcript.rs: transcript read path and caller integration
• Native Claude session path handling used by agent.usage and agent.transcript

Required changes

• Open the native session file once with a platform-appropriate no-follow mechanism.
• Validate that the opened file remains within the bound project boundary.
• Use the same file handle for metadata and bounded content reads.
• Preserve the current not_found behavior for invalid, inaccessible, or rejected transcript paths.
• Keep behavior consistent for both agent.usage and agent.transcript.

Acceptance criteria

• agent.usage and agent.transcript use a single-handle read flow for native Claude session files.
• The implementation rejects symlinks and path replacement attempts that redirect reads outside the bound project.
• Regression tests cover symlink traversal and a replacement/TOCTOU scenario where feasible on the supported platforms.
• Existing bounded-read and error behavior remains covered by tests.

Backlinks

• Deferred from PR feat(uhp): read-only agent.transcript for Claude sessions #362: feat(uhp): read-only agent.transcript for Claude sessions #362
• Review discussion: feat(uhp): read-only agent.transcript for Claude sessions #362 (comment)
• Requested by @zengbo