Snapshot path validation - #1950

moveLocalCheckpoint hardcoded the checkpoint-state and local-checkpoint
directory names; derive them from ateletpath instead. Also Lstat the
checkpoint file so a symlink is rejected rather than moved, and let
copyRootFile take a single root now that its only caller passes one.

filepath.IsLocal still let through nested paths, ".", and aliases like
"./checkpoint.img" that resolve to the same file as another entry, which
a DATA_ON_GOLDEN restore would then write concurrently. It also accepted
manifest.json, which atelet overwrites with its own record. Reject all of
these.