Prepare optional spell catalog inputs

internal/fileops/cleanup.go

@@ -22,6 +22,32 @@ func RemoveAllUnderRoot(rootPath, target string) error {
 	return removeConfinedEntry(root, targetName)
 }
 
+// RemoveFileUnderRoot removes an exact regular-file target below root without
+// following symlinked ancestors or the leaf. A missing target is successful;
+// directories, symlinks, and other non-regular entries are rejected.
+func RemoveFileUnderRoot(rootPath, target string) error {
+	root, targetName, err := openConfinedCleanupTarget(rootPath, target)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = root.Close() }()
+
+	info, err := root.Lstat(targetName)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("inspect cleanup file %q: %w", targetName, err)
+	}
+	if !info.Mode().IsRegular() {
+		return fmt.Errorf("refusing to delete non-regular file path %q", targetName)
+	}
+	if err := root.Remove(targetName); err != nil {
+		return fmt.Errorf("remove cleanup file %q: %w", targetName, err)
+	}
+	return nil
+}
+
 func openConfinedCleanupTarget(rootPath, target string) (*os.Root, string, error) {
 	if strings.TrimSpace(rootPath) == "" {
 		return nil, "", fmt.Errorf("cleanup root is required")