fix: validate managed local file descriptors (API-733) - #731

The diff adds substantial local-file hardening, quote claiming, and fail-closed bridge execution markers, with dedicated security coverage and a changeset. The previously reported authentication-directory permission issue is withdrawn because the current implementation applies ownership and write-permission checks to directories as well as files. No new correctness or security defect is verified from the reviewed code, but the CI workflow change requires requesting changes under the repository review policy.