security(attestation): reject same-inode manifest/predicate receipt pairs #2316

Finding

The new signer-facing receipt reader from #2315 rejects only textually identical absolute paths before it reads the manifest and predicate. Two different pathnames can still be hard links to the same regular inode. Because the reader closes the first descriptor before opening the second, that inode can be rewritten between reads so one physical file first supplies a valid manifest and then a valid predicate. The manifest can pre-commit the later predicate hash, so semantic validation can succeed even though the two receipt roles were never represented by distinct inodes at intake time.

This violates the existing signer-handoff intent that one leaf must not masquerade as both completion marker and predicate. It is a filesystem-identity defect, not a psychometric or signature claim.

RED / acceptance

• Add a hostile hard-link fixture using distinct pathnames that resolve to the same inode and require deterministic EvidenceError refusal before semantic validation.
• Derive receipt identity from the already-open descriptor (fstat) rather than a pathname stat, so the check is not reopened as a TOCTOU.
• Preserve the existing one-open, bounded, O_NOFOLLOW | O_NONBLOCK, regular-file and exact-byte contracts.
• Do not require st_nlink == 1; legitimate files may have other hard links. Only reject when the manifest and predicate descriptors resolve to the same (st_dev, st_ino) identity.
• Keep the reader uncredentialed. Do not add signer/OIDC authority or weaken validate_receipt_manifest().

Refs #2299 #2300 #2315 ContextualWisdomLab/TEPP#637.