feat: add deployment foundation and cross-device handoff

internal/appbundle/verify_linux_test.go

@@ -0,0 +1,29 @@
+package appbundle_test
+
+import (
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+func TestRejectFIFOWithoutOpening(t *testing.T) {
+	for _, name := range []string{"manifest.json", "config.txt", "extra"} {
+		t.Run(name, func(t *testing.T) {
+			files := basicFiles()
+			dir, pin := packageDir(t, manifest(files), files)
+			path := filepath.Join(dir, name)
+			if name != "extra" {
+				if err := os.Remove(path); err != nil {
+					t.Fatal(err)
+				}
+			}
+			if err := syscall.Mkfifo(path, 0600); err != nil {
+				t.Fatal(err)
+			}
+			// Opening a FIFO for reading would block. Verification must reject its
+			// metadata before opening it; the parent Linux run uses a test timeout.
+			rejected(t, dir, pin)
+		})
+	}
+}