daemon: wire the engine into veloxd — the vertical slice runs end to end

CORE stage 8 merged, so vdm::Engine is linkable. This closes D4a and
narrows D4b: `velox add <url>` now actually downloads.

- sched/engine_port_core.hpp — the real EnginePort: forwards to a live
  vdm::Engine, keeps the DownloadHandle per task for pause/resume/
  cancel/provide_auth/decide/refresh_url, drives set_task_order /
  set_max_active_segments / set_host_segment_cap via
  engine.segment_budget(). CORE confirmed the admission model: DAEMON
  decides when to start(); the engine's own download_task calls
  register_task/set_want internally — DAEMON never touches per-task
  budget calls. EnginePort gains release(TaskId) so the port drops a
  handle when the task goes terminal.
- rpc/event_loop — EventLoop::post(fn): thread-safe, runs fn on the
  loop thread next iteration. The marshaller for engine-thread
  callbacks.
- main.cpp — constructs vdm::Engine + EnginePortCore + Scheduler
  (post_to_loop = loop.post). At startup: reconcile_after_restart()
  (ADR 0013 §5), reload_config(), tick(). A 1 s timerfd on the loop
  re-runs tick() (schedule windows, missed nudges); download.add nudges
  via dispatcher.set_on_mutation.

End-to-end verified against tools/testserver: `velox add
http://127.0.0.1:.../file/512K` -> task queued -> scheduler admits ->
engine downloads 524288 bytes -> complete, file on disk. First
byte-path all the way through the project.

safepath-adversarial.md: re-verified per its own note — CORE landed
O_NOFOLLOW on the target open (core/src/io/sparse_file.cpp), so the
leaf-symlink TOCTOU is now closed; residual is down to one
intermediate-dir gap (documented post-M1 chase).

36 daemon/cli tests green; scheduler + uds_roundtrip TSan-clean.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Upd9WhG9oppieig5nRDLig

daemon/docs/safepath-adversarial.md

@@ -58,32 +58,27 @@ Roots for the examples: `allowedRoots = ["/home/u/Downloads", "/data/dl"]`, alre
    `-32011`. Then re-derive the final dir's path from its fd (`/proc/self/fd/N`) and
    re-assert containment. (A8 for the created tail, A14)
 5. **Best-effort leaf check:** `fstatat(dir_fd, leaf, AT_SYMLINK_NOFOLLOW)` — refuse if it
-   is already a symlink. This narrows, but does not close, the create-after-check race on
-   the leaf: a symlink planted *after* this `fstatat` and *before* CORE opens the file is
-   still followed. Closing it needs CORE to open with `O_NOFOLLOW` (plus `O_EXCL` on a
-   fresh download). **Verified 2026-09-10: it does not yet** —
-   `core/src/io/sparse_file.cpp:77` is `O_WRONLY | O_CREAT | O_CLOEXEC`. The flag change
-   has been raised with CORE; until it lands this race is open, see the residual below.
+   is already a symlink. This narrows the create-after-check race on the leaf; it is fully
+   closed by CORE opening the download target with `O_NOFOLLOW`. **Verified 2026-09-11:
+   `core/src/io/sparse_file.cpp` opens `O_WRONLY | O_CREAT | O_CLOEXEC | O_NOFOLLOW`** — a
+   symlink swapped in as the leaf after our check fails there with `ELOOP` ->
+   `Error::path_rejected`. (No `O_EXCL`: resume must be able to open an existing
+   `.veloxpart`.)
 6. **Every failure is `-32011`, `data.path` = the *original* `saveDir`** — never the
    resolved path, which would leak where the roots actually live. The one exception is a
    `filename` that violates the schema's own `maxLength`, which is `-32602` at the param
    layer before this code runs.
 
-### Residual — currently OPEN, tracked
+### Residual — one gap, narrowed
 
-Two TOCTOU gaps this code does not close on its own:
+**The leaf-symlink TOCTOU is closed** (step 5, verified 2026-09-11: CORE opens the target
+`O_NOFOLLOW`). What remains:
 
 1. **An existing intermediate directory** swapped for an out-of-root symlink between our
    `realpath` (step 3) and the write. Step 3 trusts `realpath` for the pre-existing
-   prefix; a full `O_NOFOLLOW` chase would reject the legitimate symlinked directories
-   A16 requires us to allow.
-2. **The leaf** swapped for a symlink between our `fstatat` (step 5) and CORE's `open`.
-
-Both are closed by CORE opening the file `O_NOFOLLOW` (and, for a fresh download,
-`O_EXCL`). **As verified on 2026-09-10 that is not yet the case** —
-`core/src/io/sparse_file.cpp:77` opens `O_WRONLY | O_CREAT | O_CLOEXEC`. The flag change has
-been raised with CORE; when it lands, update step 5 and this paragraph and re-verify the
-flags at that line.
+   prefix; `O_NOFOLLOW` on the *file* open does not re-check the *directories* above it,
+   and a full `O_NOFOLLOW` directory chase would reject the legitimate symlinked
+   directories A16 requires us to allow.
 
 What limits the exposure *today*: the download directory lives under `~/.local/share` /
 `~/Downloads`, both `0700` — an attacker planting a symlink there already has write access