fix: harden operations and configuration recovery

internal/target/diagnostic.go

@@ -69,6 +69,14 @@ func readOnlyWritablePath(path string) (bool, string) {
 		}
 		if index == len(components)-1 {
 			_ = unix.Close(child)
+			if kind != unix.S_IFREG {
+				return false, componentPath + " is not a regular file"
+			}
+			readable, readErr := unix.Openat(current, component, unix.O_RDONLY|unix.O_NONBLOCK|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+			if readErr != nil {
+				return false, componentPath + " cannot be read for safe atomic replacement: " + readErr.Error()
+			}
+			_ = unix.Close(readable)
 			return writableDirectory(current, currentPath, absolute)
 		}
 		if kind != unix.S_IFDIR {