Harden filesystem safety and command contracts

[snapsynapse]

What changed

• reject source/link path aliases before destructive synchronization
• resolve parent-directory symlinks at the mutation boundary while preserving explicit hardlink force behavior
• make backup naming collision-safe without overwriting existing backups
• ensure installed Git hooks are executable
• make scan return a failing exit status when any link operation fails
• make empty detect generation a clearly messaged successful no-op
• document backup behavior on filesystems without hard-link support
• add focused unit and integration evals for each mitigation

Why

The review identified paths where force synchronization could replace the source, backup collisions could overwrite prior data, existing hooks could remain inert, and automation could receive misleading success or invalid generated configuration.

Impact

Filesystem mutations now fail safely around source aliases and unsupported backup filesystems. Bulk scan failures are visible to automation. Detection remains friendly when no additional links are required. Existing intentional hardlinks can still be replaced with explicit --force.

Validation

• go test -race ./...
• go vet ./...
• go test -tags=integration -race .
• staticcheck ./...
• misspell -error .
• git diff --check