Fix cross-platform authority checks

[gorajing]

Summary

• reject wrong-case knowledge-base authority before dereferencing exact paths
• keep ledger temporary inodes pinned through installation and readback
• reject IANA non-global special-purpose IP ranges while preserving global IPv6 exceptions

Verification

• npm run typecheck
• npm test (129 files, 1456 passed, 1 skipped)
• npm run verify-contracts (40 checks, 0 failures)
• npm run health (0 errors, 0 warnings)
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a17bd1359e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Move IPv6 exceptions before the range guard

For every address in the new global exception list, ipaddr.js 2.4.0 classifies the address as a named special range rather than unicast (for example 2001:3::1 is amt, and 2001:1::1 falls under reserved; see the locked package source at https://raw.githubusercontent.com/whitequark/ipaddr.js/v2.4.0/lib/ipaddr.js). This guard returns before GLOBALLY_REACHABLE_IPV6_SPECIAL_RANGES is checked, so isPublicIpAddress("2001:3::1") and the other new positive test cases still return false, causing safe fetches to those globally reachable exceptions to be rejected.

Useful? React with 👍 / 👎.