Harden debug bundle filesystem collaborators

internal/core/fileio/fileio_test.go

@@ -39,3 +39,18 @@ func TestWriteBytesIsAtomicAndUsesRequestedModes(t *testing.T) {
 		}
 	}
 }
+
+func TestWriteBytesRejectsSymlinkedComponents(t *testing.T) {
+	root := t.TempDir()
+	outside := t.TempDir()
+	if err := os.Symlink(outside, filepath.Join(root, "link")); err != nil {
+		t.Skipf("symbolic links unavailable: %v", err)
+	}
+
+	if err := WriteBytes(root, "link/value", []byte("value"), 0o700, 0o600); err == nil {
+		t.Fatal("WriteBytes accepted a symlinked directory")
+	}
+	if _, err := os.Stat(filepath.Join(outside, "value")); !os.IsNotExist(err) {
+		t.Fatalf("write escaped through symlink: %v", err)
+	}
+}