Keep CopyService file access inside the checkpoint root

[garagon]

Summary

Keep files opened by CopyService inside its checkpoint root.

Send receives a checkpoint name, while Register receives a path prefix and name. Both eventually reached mmap_file, which previously concatenated those values and opened the result without checking where it resolved. A client able to reach CopyService could therefore ask the service account to open a file outside ROOT_DIR.

What changed

• Resolve the requested file and reject targets outside ROOT_DIR.
• Open the file, then verify the path of that file descriptor before mmap. This closes the symlink-change window between path resolution and open.
• Preserve the existing Send and Register prefix behavior for valid checkpoint files.
• Add coverage for normal send/register paths, parent traversal, absolute and external paths, symlink escapes, and an already-open external file.
• Declare serial_test as a development dependency because existing library tests already use it.

This is a service-boundary check. It does not assume CopyService is publicly reachable; impact depends on a client being able to call the service and on the service account's file permissions.

Validation

Validated on Linux in rust:1-bookworm with the package's native dependencies installed:

• cargo fmt --all -- --check
• cargo test -p xai-recsys-engine --lib: 68 passed, 1 ignored
• cargo clippy -p xai-recsys-engine --lib --tests -- -A clippy::useless-conversion -A clippy::collapsible-if -D warnings

The two allowed Clippy rules are pre-existing warnings in unchanged files.