test(cache): pin the remove_cached containment guard against a symlink escape

[MichaelTaylor3d]

What changed

Closes #1622.

(a) — the containment guard was untested (fixed). remove_cached_rejects_path_traversal fed a non-hex key ("../../etc"), which the 64-hex validator (CapsuleKey::parse) refuses before any path is built — so the canonicalize + starts_with(cache) containment guard in capsule_store.rs (cache_remove_cached) was never exercised. If that guard were deleted, the test still passed.

A valid 64-hex key can't contain .//, so it can never escape <cache>/modules on its own — the guard is defense-in-depth against a compromised cache layout. The new test exercises it directly:

• remove_cached_containment_guard_refuses_a_symlink_escape (#[cfg(unix)]): plants a symlink at <cache>/modules/<store> → a separate out-of-cache tempdir holding <root>.module, then asserts a well-formed cache_remove_cached is refused ("outside the cache") and the outside file survives.
• Mutation-verified: with the guard block deleted the test FAILS (the outside file is unlinked); with it restored it passes. The test pins the guard.
• Renamed the existing test → remove_cached_rejects_a_non_canonical_key_at_the_validator so each test names the gate it actually pins.

(b) — already satisfied, no change. #1622's second concern (the availability-batch non-canonical-key test being vacuous) is already resolved in current code: availability_batch_rejects_a_non_canonical_key_without_touching_the_filesystem now plants a real out-of-cache secret.module and drives .. / ../secret traversals that collapse onto it, so available == false is non-vacuous — it would answer true without the guard. Documented in the commit body; nothing to change.

Verification

• New + renamed tests green; mutation check confirms the new test fails without the guard.
• cargo fmt --all -- --check clean · cargo clippy -p dig-node-core --all-targets --all-features -D warnings clean.

Version

test: → patch bump [workspace.package].version 0.72.5 → 0.72.6.

---

Generated by Claude Code