fix(firecracker): harden committed-snapshot resume against guest-controlled data

Address the codex review on #398:

- P1: inject_guest_boot no longer follows a symlink at bb-init/bb-dropbear.
  A committed snapshot is guest-controlled and could plant those paths as
  symlinks aimed at a host file (e.g. bb-init -> ~/.bashrc); write_text /
  copy2 would then overwrite the target as the host user during resume.
  Replace any pre-existing entry and create the files with
  O_EXCL|O_NOFOLLOW so the write stays inside the staging tree.

- P2: write the snapshot tar owner-only (0600). It can contain the bottle's
  private workspace; it was being created world-readable (0644).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UoEZHDjv84ChoZbozQERhJ

bot_bottle/backend/firecracker/freezer.py

@@ -63,7 +63,11 @@ def _commit_rootfs_via_ssh(private_key: Path, guest_ip: str, tar_path: Path) ->
     tar_path.parent.mkdir(parents=True, exist_ok=True)
     partial = tar_path.with_name(tar_path.name + ".partial")
     ssh = util.ssh_base_argv(private_key, guest_ip)
-    with open(partial, "wb") as tar_out:
+    # The snapshot can contain the bottle's private workspace, so keep it
+    # owner-only (0600) — create it that way and re-assert after the rename
+    # (os.replace carries the source mode, but be explicit).
+    fd = os.open(partial, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "wb") as tar_out:
         result = subprocess.run(
             [*ssh, "--", "tar", "--create", "--one-file-system",
              "--exclude=./proc", "--exclude=./sys", "--exclude=./dev",
@@ -75,3 +79,4 @@ def _commit_rootfs_via_ssh(private_key: Path, guest_ip: str, tar_path: Path) ->
         die(f"ssh tar for {guest_ip} failed: "
             f"{(result.stderr or b'').decode().strip() or '<no stderr>'}")
     os.replace(partial, tar_path)
+    os.chmod(tar_path, 0o600)