fix(R-1187 b): the import writes only through os.Root — never through a link that leaves the app's folder

Found by the automated security review of dfd0f8e. Red-proved. Commit only.

CHANGELOG.md

@@ -34,6 +34,9 @@ hub answers 400 to both and nothing else changes.
   runs `psql -v ON_ERROR_STOP=1`. Tests `internal/appexport/r1187_abdfg_test.go` (6), red-proved with the old behaviour
   behind the new function shapes (link packing error, a 10-s hang on the FIFO, link not restored, import not refused,
   bad paths accepted, postgis missed).
+  **Follow-up (the automated security review, same night):** the import writes only through `os.Root`, so no entry is
+  written through a link already in the folder that points outside; such an entry is refused and listed. Test
+  `TestR1187b_NoWriteThroughALinkThatLeavesTheFolder`, red-proved (the file landed outside with plain `os.Create`).
 - **R-1298:** the hold report skips an install's hold (`unhealthy_stop`, `update_failed`, `putback_pending`) of an app that
   is not installed (`holdreport.Reporter.SetInstalled`: the app's `app.yaml` exists — an unreadable one still counts,
   R-1220) and reports it cleared if it was reported; a restore hold is always reported (R-379). 9202's four orphan holds