Server-only no-link data jail for table opens

[bedipritpal]

Stage5: server-only no-link table-open data jail, based on upstreamb06fa2e4 afterPR189.

• Serverd installs configured data roots and extra-listener roots before listeners, refusing startup if roots cannot be anchored safely.
• POSIX uses pinned root descriptors, component-by-component openat/O_NOFOLLOW and verified parent handles. Windows pins verified directory handles without share-delete and checks reparse leaves before truncation.
• Jailed path resolution preserves original components; connection containment and memo failures remain fail-closed. Jailed ABI materialize/restructure/copy/clone writes use File opens. Local/DLL behavior remains unchanged without an installed jail.

Compatibility: symlinked roots/directories/table/index/memo leaves are refused server-side, including a .cdx symlink to .z01. Deployments using those layouts need ordinary files/directories. This is no-link table-open hardening, not a complete OS filesystem sandbox: hard links, mounts, existing path-based rename/unlink operations and exhaustive adversarial directory-rename races are not claimed covered.

9files (+838/-27). No client wire/capability, count-cache policy/OPENADS_FRESH_COUNTS, lock algorithm, health backend, Harbour RDD core, daemon-hardening exemption or CI/workflow change.

Credit: scoped hunks derive from Pritpal Bedi's released mtfix41 source (6dffce5), with added tests for multiple/longest roots, failed replacement preserving policy and pinned POSIX root replacement. No full-function/source identity claim.

Validation: fresh isolated Linux normal/TLS unit/ACE/serverd builds; combined stage4+stage5 selection85cases/1,761assertions each. Changed Linux units and jail tests pass strict Clang14 warning checks. Invalid-root serverd exits1 before listeners. No fullCTest, hosted cross-platform validation or exhaustive bypass/race audit claim. Windows source reviewed, not locally run; reparse/junction-specific test coverage remains a limitation