Validate ancestor identities before safeWriteText creates directories or stages content #2388

Summary

In src/services/file-safety/safeWriteText.ts, validate caller-supplied expectedAncestorIdentities before creating target parent directories or staging content. Keep the existing pre-commit validation.

Currently, recursive mkdir and staging occur before the identity check. A replaced ancestor can redirect directory creation and staging before the write is rejected. On Windows, staging under the redirected directory can inherit broader ACLs. Created parent directories can remain after rejection.

Design constraints

• Preserve the created-ancestor information used by _createdAncestorChain and the post-commit directory fsync sequence.
• Decide how to validate before creation and revalidate before publication without claiming to eliminate races that path-based operations cannot eliminate.
• Preserve error distinctions: missing or replaced ancestors produce AncestorReplacedError, while unrelated inspection failures such as EACCES propagate.
• Address the independent Windows DACL protections separately as needed; an earlier ancestry check alone does not make staging private.

Acceptance criteria

• When expectedAncestorIdentities indicates an ancestor was already replaced, reject before creating parent directories or staging content, including when expectedResolvedPath is absent.
• Retain the pre-commit check and test replacement between initial validation and publication.
• Test newly created parent directories and verify that the created-ancestor fsync behavior remains intact.
• Test missing or replaced ancestors and propagation of unrelated inspection errors.

Requested by @easonLiangWorldedtech.

PR: #2385
Review comment: #2385 (comment)
Related split plan: #2350