What: the restore temp is a per-pid name, unlinked first and created O_CREAT|O_EXCL (0600).
Why: tmp.write_bytes followed a symlink/hardlink left at the fixed '<name>.restore' name, so a
same-user link redirected the write and could replace the obligation with the link.
Red (pre-fix disarm): sentinel 'PRECIOUS' overwritten with 'ORIGINAL'.
Green: sentinel untouched; obligation is a regular file holding ORIGINAL.