security(attestation): pin sealed evidence root by descriptor across path swaps #2304

Finding

The current scientific-validation verifier validates --evidence-root path components, enumerates that pathname, and then opens the evidence leaf by pathname. O_NOFOLLOW protects only the leaf component. If the validated root directory is renamed/replaced with a symlink between root validation/enumeration and leaf open, the subsequent leaf open can traverse the replaced ancestor and read a different directory.

This is a path-authority TOCTOU gap, distinct from #2302's same-leaf double-read defect and #2303's special-file blocking defect. The exact evidence bytes are still read once, but the directory authority used to select those bytes is not pinned for the duration of intake.

Required repair

• Add a realistic hostile RED that swaps the validated root pathname to a symlink immediately before the evidence read. The predecessor should accept bytes from the replacement directory when the caller-supplied SHA matches those bytes.
• Open the sealed root through directory descriptors without following symlink components and retain that descriptor through cardinality enumeration and leaf open.
• Enumerate members from the pinned directory descriptor and open the sole evidence filename relative to that descriptor (dir_fd / openat semantics) with the existing O_NOFOLLOW | O_NONBLOCK leaf controls.
• Preserve the one-byte-snapshot hash/parse semantics, strict schema/binding checks, and output-boundary rules.
• Keep this an unsigned local-integrity control; do not describe it as provenance authentication or a signed attestation.
• Add the hostile case to the existing exact-head 100% owned coverage gate.

Acceptance

A root-path replacement after the directory descriptor is acquired cannot redirect evidence selection. Exact-head hosted GREEN and independent review are still required before normal landing. No force push, gate weakening, or predecessor receipt reuse.

Refs #2299 #2300 #2302 #2303 ContextualWisdomLab/TEPP#637.