Reduce redundant filesystem syscalls

[charliemarsh-oai]

Summary

• write atomic file contents through the already-open temporary file instead of reopening its pathname
• retain directory classification from file-search walking instead of restatting every returned match
• use symlink metadata first and follow metadata only for symlinks
• replace existence checks before daemon connections and environment config reads with single operations and error handling
• cover followed directory symlinks and broken symlinks

Why

Several paths performed redundant filesystem syscalls or split a check from the operation it guarded. Besides extra I/O, reopening the temporary pathname creates a substitution race, and preflight existence checks can go stale before the subsequent operation. Performing the operation directly preserves behavior while avoiding those windows.

The affected crate tests pass, along with scoped Clippy and formatting. The full TUI suite continues to have the two known Guardian feature-flag persistence failures present on main; the focused daemon socket tests pass.