test(artifacts): skip directory symlink traversal test on Windows without symlink privileges - #10542

Summary

Skips the directory symlink traversal test in ReleaseExposureReader.test.ts on Windows where unprivileged symlink creation fails with EPERM.

Problem and expected behavior

In src/artifacts/ReleaseExposureReader.test.ts (line 2661), the test "keeps symlink traversal in a selected directory path" attempts to create a directory symlink using await symlink(join(root, "real", "child"), join(root, "link")).

On Windows, creating symlinks without Developer Mode or elevated privileges (SeCreateSymbolicLinkPrivilege) throws EPERM: operation not permitted, symlink.

Other symlink tests in this file (lines 1204, 1226, 1246, 1259, 4794, 4835) already use it.skipIf(process.platform === "win32"), but line 2661 missed the guard.

Expected behavior: The test should be skipped on Windows when run unprivileged, matching the rest of the test suite.

Change and scope

• Wrapped the test in it.skipIf(process.platform === "win32").
• Test-only change, no runtime impact.

Contract and boundary impact

• Semantic owner and earliest changed stage: tests only
• Contribution scope fit and linked maintainer decision: not applicable
• CLI and MCP/tool-catalog contract: none
• Provider, bridge, target-format, or platform compatibility: Windows test portability
• Evidence, artifact, provenance, or reconstruction contract: none
• Target selection, authority, upstream behavior, and cleanup details: not applicable
• Generated metadata, package, or installation impact: none

Expected effects:

• Documentation or usability only; no target interaction.

Evidence and regression coverage

• Tests added or updated: src/artifacts/ReleaseExposureReader.test.ts
• Base reproduction: keeps symlink traversal in a selected directory path throws EPERM on Windows without symlink privileges.
• After fix: Test is cleanly skipped on Windows.
• Remaining proof gaps: none.

For evidence-bearing changes:

• Observed, derived, and inferred claims remain distinguishable.
• Artifact identity, source provenance, and failed attempts remain preserved.
• Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

• Verified against Node on Windows 11.
• Test is cleanly skipped on Windows without EPERM errors.

Compatibility, safety, and release

• Breaking changes or migration steps: none
• Real Hopper/Ghidra, browser, or OS coverage: Windows 11
• Package or release metadata impact: none
• Security, privacy, process, or containment review: test-only

Author readiness

Human owner: @pellurusaranya-byte

• I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
• I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
• I declare this PR ready for initial maintainer review.

Before merge

• This PR addresses a concrete problem or an agreed enhancement.
• Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
• The PR has one focused outcome and the title follows type(scope): outcome.
• Related issue is linked, or the reason for not linking one is stated above.
• Tests cover changed observable behavior and meaningful failure paths.
• Owning docs, contracts, and generated metadata are updated where needed.
• User-visible CLI/MCP changes include representative output.
• I checked the final diff for secrets, unrelated cleanup, and unsupported claims.