Summary

saveDownloadPayload in pw-tools-core.downloads.ts uses DEFAULT_DOWNLOAD_DIR as the root directory for writeViaSiblingTempPath, but user-specified explicit download paths are not constrained to that directory. This causes:

1. Path validation failures when the explicit output path is outside DEFAULT_DOWNLOAD_DIR (e.g., in os.tmpdir())
2. Hardlink alias escape false positives because writeFileFromPathWithinRoot in output-atomic.ts detects hardlinks as alias escapes — the safe-copy approach reads through the link, but the root-boundary check rejects the resolved path

Reproduction

Three tests in pw-tools-core.waits-next-download-saves-it.test.ts fail on main:

• saves to explicit output path
• creates parent directories for the explicit output path
• does not overwrite outside files when explicit output path is a hardlink alias

```
pnpm test src/browser/pw-tools-core.waits-next-download-saves-it.test.ts
```

Expected behavior

Downloads to explicit user-specified paths should succeed, and hardlink aliasing should be safely neutralized by the atomic rename (which replaces the directory entry rather than writing through it).

Environment

• OS: macOS (Darwin 25.2.0)
• Node: v22+
• OpenClaw: main branch (as of 2026-03-03)