State: atomic save/load with secure dir + quarantine + advisory lock

[heusalagroupbot]

Scope

• Adds atomic snapshot save with fsync and latest.json pointer
• Implements load with integrity checks and quarantine
• Introduces coarse advisory lock and secure dir validation

Why

• Reliable, secure persistence for state bundle

Testing

• Focused: === RUN TestLoadLatestStateBundle_OK
  --- PASS: TestLoadLatestStateBundle_OK (0.02s)
  === RUN TestLoadLatestStateBundle_RejectsInsecureDir
  --- PASS: TestLoadLatestStateBundle_RejectsInsecureDir (0.01s)
  === RUN TestLoadLatestStateBundle_MissingLatest
  --- PASS: TestLoadLatestStateBundle_MissingLatest (0.00s)
  === RUN TestLoadLatestStateBundle_CorruptLatest
  --- PASS: TestLoadLatestStateBundle_CorruptLatest (0.00s)
  === RUN TestLoadLatestStateBundle_UnknownVersion
  --- PASS: TestLoadLatestStateBundle_UnknownVersion (0.02s)
  === RUN TestLoadLatestStateBundle_MissingSnapshot
  --- PASS: TestLoadLatestStateBundle_MissingSnapshot (0.00s)
  === RUN TestLoadLatestStateBundle_PermissionDenied
  --- PASS: TestLoadLatestStateBundle_PermissionDenied (0.01s)
  === RUN TestLoadLatestStateBundle_SnapshotHashMismatch_QuarantineBoth
  --- PASS: TestLoadLatestStateBundle_SnapshotHashMismatch_QuarantineBoth (0.02s)
  === RUN TestLoadLatestStateBundle_CorruptSnapshotJSON_QuarantineBoth
  --- PASS: TestLoadLatestStateBundle_CorruptSnapshotJSON_QuarantineBoth (0.01s)
  === RUN TestSaveStateBundle_WritesFilesAtomicallyWithPermsAndPointer
  --- PASS: TestSaveStateBundle_WritesFilesAtomicallyWithPermsAndPointer (0.02s)
  === RUN TestSaveStateBundle_AdvisoryLock_AllowsSingleWriter
  === PAUSE TestSaveStateBundle_AdvisoryLock_AllowsSingleWriter
  === RUN TestSaveStateBundle_InvalidBundle
  --- PASS: TestSaveStateBundle_InvalidBundle (0.00s)
  === RUN TestSaveStateBundle_SanitizesSecretsAndRejectsInsecureDir
  --- PASS: TestSaveStateBundle_SanitizesSecretsAndRejectsInsecureDir (0.01s)
  === CONT TestSaveStateBundle_AdvisoryLock_AllowsSingleWriter
  --- PASS: TestSaveStateBundle_AdvisoryLock_AllowsSingleWriter (0.11s)
  PASS
  ok github.com/hyperifyio/goagent/internal/state 0.265s

Relation

• Builds upon PR State: versioned StateBundle schema (v1) with validation #50 (state schema)

Tracking

• Will record under and on develop.

[heusalagroupbot]

Detected dependency: blocked by #50 — State: versioned StateBundle schema. Reason: save/load builds on the schema introduced in #50; please review/merge #50 first. I’ll park behavior‑changing edits here and proceed with safe prep only while continuing the sweep on unblocked PRs.

[thejhh]

Looks fine