Reject symlinks in package source collection (audit 5.2)

`collect_rsscript_files_excluding` used `Path::is_dir`/`is_file`, which follow
symlinks, so a package could place a symlinked `.rss`/`.rssi` (or symlinked dir)
under a source root pointing outside the package and have review/lock/metadata
read it — an info-leak / nondeterminism vector in CI on untrusted packages.

Use `DirEntry::file_type()` (does not dereference) and fail closed on any
symlinked entry in the source tree. (A symlinked source *root* was already
caught by canonicalization in `confined_manifest_path`.) Add a unix test that a
symlinked source file is rejected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Haofei

src/package/source_set.rs

@@ -542,10 +542,22 @@ fn collect_rsscript_files_excluding(
     for entry in entries {
         let entry = entry
             .map_err(|error| format!("failed to read entry in {}: {error}", path.display()))?;
+        // `file_type()` does NOT follow symlinks (unlike `Path::is_dir`/`is_file`).
+        // Reject symlinked entries so a package cannot point review/lock/metadata
+        // at files outside its own root (symlink escape).
+        let file_type = entry
+            .file_type()
+            .map_err(|error| format!("failed to stat entry in {}: {error}", path.display()))?;
+        if file_type.is_symlink() {
+            return Err(format!(
+                "refusing to follow symlink in package source tree: {}",
+                entry.path().display()
+            ));
+        }
         let path = entry.path();
-        if path.is_dir() {
+        if file_type.is_dir() {
             collect_rsscript_files_excluding(&path, excluded_roots, files)?;
-        } else if super::is_rsscript_source_path(&path) {
+        } else if file_type.is_file() && super::is_rsscript_source_path(&path) {
             files.push(path);
         }
     }

tests/checker_package.rs

@@ -8354,3 +8354,35 @@ platform-env = {{ path = "{}", platform_provided = true }}
         })
     }));
 }
+
+#[cfg(unix)]
+#[test]
+fn package_source_collection_rejects_symlink_escape() {
+    use std::os::unix::fs::symlink;
+
+    let dir = common::unique_temp_dir("rsscript-package-symlink");
+    fs::create_dir_all(dir.join("interface")).expect("interface dir");
+    fs::write(
+        dir.join("rsspkg.toml"),
+        "[package]\nname = \"sym\"\nversion = \"0.1.0\"\nedition = \"2026\"\n\n[interfaces]\npaths = [\"interface\"]\n",
+    )
+    .expect("manifest");
+    fs::write(dir.join("interface/lib.rssi"), "pub fn Sym.ok() -> Unit\n").expect("interface");
+
+    // A secret outside the package the symlink will try to pull into review.
+    let outside = common::unique_temp_dir("rsscript-package-symlink-outside");
+    fs::create_dir_all(&outside).expect("outside dir");
+    let secret = outside.join("secret.rssi");
+    fs::write(&secret, "pub fn Secret.leak() -> Unit\n").expect("secret");
+    symlink(&secret, dir.join("interface/evil.rssi")).expect("symlink");
+
+    let result = review_package_dir(&dir);
+    let _ = fs::remove_dir_all(&dir);
+    let _ = fs::remove_dir_all(&outside);
+
+    let error = result.expect_err("a symlinked source file must be rejected, not followed");
+    assert!(
+        error.contains("symlink"),
+        "expected a symlink rejection error, got: {error}"
+    );
+}