fix: close two file-system race windows flagged by CodeQL

Both are js/file-system-race (TOCTOU) findings:

- server/src/translation.ts ensureTraConfig: replace the existsSync-then-write
  check with an atomic exclusive create (writeFileSync flag "wx"), treating
  EEXIST as the intended no-op. This makes the "never clobbers an existing
  project config" guarantee actually atomic instead of racy.
- binary/src/cli.ts loadJsonToBinary: open the JSON file once and fstat + read
  through the same descriptor, so the size check and the read operate on one
  inode. A statSync->readFileSync pair on the path could otherwise be swapped
  between check and read to bypass the snapshot-input size cap.

Behavior is unchanged on the normal paths (same error messages and exit codes);
binary CLI, binary unit, and server translation suites pass.

Author: burner1024

binary/src/cli.ts

@@ -198,34 +198,32 @@ Examples:
  * Validation and semantic round-trip checks happen inside the shared snapshot loader.
  */
 function loadJsonToBinary(jsonPath: string, parseOptions: ParseOptions): void {
-    let stat: fs.Stats;
+    // Open once, then fstat and read through the SAME descriptor so the size check and the read
+    // operate on one inode. A statSync->readFileSync pair on the path leaves a TOCTOU window
+    // (CodeQL js/file-system-race) where a file swapped after the check could bypass the input cap.
+    let fd: number;
     try {
-        stat = fs.statSync(jsonPath);
+        fd = fs.openSync(jsonPath, "r");
     } catch (error) {
         if ((error as NodeJS.ErrnoException).code === "ENOENT") {
             console.error(`Not found: ${jsonPath}`);
             process.exit(1);
         }
         throw error;
     }
-    if (stat.size > MAX_JSON_SNAPSHOT_INPUT_BYTES) {
-        console.error(
-            `File too large: ${stat.size} bytes (snapshot input cap is ${MAX_JSON_SNAPSHOT_INPUT_BYTES}); refusing to read ${jsonPath}`,
-        );
-        process.exit(1);
-    }
 
     let jsonText: string;
     try {
-        // Read with try/catch instead of existsSync->readFileSync to avoid
-        // the TOCTOU window CodeQL js/file-system-race flags.
-        jsonText = fs.readFileSync(jsonPath, "utf-8");
-    } catch (error) {
-        if ((error as NodeJS.ErrnoException).code === "ENOENT") {
-            console.error(`Not found: ${jsonPath}`);
+        const size = fs.fstatSync(fd).size;
+        if (size > MAX_JSON_SNAPSHOT_INPUT_BYTES) {
+            console.error(
+                `File too large: ${size} bytes (snapshot input cap is ${MAX_JSON_SNAPSHOT_INPUT_BYTES}); refusing to read ${jsonPath}`,
+            );
             process.exit(1);
         }
-        throw error;
+        jsonText = fs.readFileSync(fd, "utf-8");
+    } finally {
+        fs.closeSync(fd);
     }
 
     const loaded = loadBinaryJsonSnapshot(jsonText, parseOptions);

server/src/translation.ts

@@ -465,11 +465,17 @@ export class Translation {
     private ensureTraConfig(relDir: string): void {
         if (!this.workspaceRoot) return;
         const configPath = path.join(this.workspaceRoot, ".bgforge.yml");
-        if (fs.existsSync(configPath)) return;
         try {
-            fs.writeFileSync(configPath, yaml.stringify({ mls: { translation: { directory: relDir } } }));
+            // `flag: "wx"` creates the file only if it does not already exist and fails with EEXIST
+            // otherwise, so an existing project config is never clobbered - atomically, with no
+            // existsSync->writeFileSync TOCTOU window.
+            fs.writeFileSync(configPath, yaml.stringify({ mls: { translation: { directory: relDir } } }), {
+                flag: "wx",
+            });
             conlog(`Translation: created .bgforge.yml (translation.directory: ${relDir})`);
         } catch (error) {
+            // File already present: the config exists, nothing to create - not a failure.
+            if ((error as NodeJS.ErrnoException).code === "EEXIST") return;
             conlog(`Translation: could not create .bgforge.yml: ${errorMessage(error)}`, "warn");
         }
     }