security(shared): fix -K TOCTOU, ssh old-args quoting, TLS opts, secret-file perms, sparse dedup

- file: open -K dirlink referents via a race-safe relative O_NOFOLLOW walk
  from the authorized-root fd instead of re-opening an absolute realpath()
  result (removes the intermediate-symlink swap TOCTOU).
- transport_ssh: always single-quote the server path, including --old-args,
  so no mode can inject shell metacharacters.
- transport_tls: set SSL_OP_NO_COMPRESSION and (guarded) SSL_OP_NO_RENEGOTIATION.
- credentials: reject --password-file/--early-input with any group/other
  permission bit; chmod 0600 the affected test fixtures.
- file_store: export file_store_write_sparse() and remove the verbatim
  file.c duplicate.

tests/test_transport_ssh.c

@@ -55,8 +55,14 @@ static void test_ssh_remote_command_argument_modes() {
   EXPECT_EQ_STR(command, "'fast'\\''sync' --stdio");
   free(command);
 
+  /* --old-args no longer disables injection-safe quoting: the path is still one
+     single-quoted word, even when it carries shell metacharacters. */
   command = ssh_build_remote_command("fast sync; touch /tmp/pwned", true, NULL, 0);
-  EXPECT_EQ_STR(command, "fast sync; touch /tmp/pwned --stdio");
+  EXPECT_EQ_STR(command, "'fast sync; touch /tmp/pwned' --stdio");
+  free(command);
+
+  command = ssh_build_remote_command("fast'sync; rm -rf /", true, NULL, 0);
+  EXPECT_EQ_STR(command, "'fast'\\''sync; rm -rf /' --stdio");
   free(command);
 }
 
@@ -131,9 +137,9 @@ static void test_ssh_remote_command_with_remote_options() {
   free(command);
   free(val);
 
-  /* --old-args leaves the server path unquoted but still quotes remote options. */
+  /* --old-args still quotes both the server path and the remote options. */
   command = ssh_build_remote_command("srv", true, multi, 2);
-  EXPECT_EQ_STR(command, "srv --stdio '-v' '--allow-delete'");
+  EXPECT_EQ_STR(command, "'srv' --stdio '-v' '--allow-delete'");
   free(command);
 }