[monsterlag]

Reject a pre-existing symbolic link at versions/<tag>.part before stale-folder cleanup, part placement or download. Leave the link untouched and report the exact staging path through the existing update-error flow. Symlinked parent installation roots remain supported.

Current main reaches cleanup or part placement before failing on these links. Pending #1327 canonicalizes the staging root in _place, so a dangling staging leaf can instead select its resolved target before the new ZIP checks. This is a separate leaf check; it does not duplicate or change #1327's archive containment rules.

Thanks to @Demonicmurderer for #1295 and @bronze-ff for the related #1327.

Validation:

• Extended the existing Linux updater fixture. Identical assertions fail both link cases on main and pass after the fix; fresh staging, stale real staging, and a symlinked parent root pass throughout.
• The strict selected Linux runner passes (one check, all 12 test methods). All 10 pre-existing methods are unchanged.
• A separate authored temp-only probe of exact Keep Linux update extraction from writing through symlinks #1327 source reaches an injected unpack barrier with the resolved target; no outside-staging write is performed. The two-line guard overlaid on that source passes the same five new scenarios.

The new regression uses temporary paths and doubles, with no network or real archive/installer execution. The existing Linux-only test scope is retained; no Windows symlink privilege is required. This does not establish archive integration coverage or protection against concurrent replacement of the staging leaf.

All eight hosted validation checks pass on b65d80e, including Linux/Windows source checks, the Windows Builder/setup and renderer builds, and the Linux AppImage. Release publishing is skipped for the PR.