populate: never write through files or change hard links elsewhere

Populate writes some files in place, and makes files writable, which
reaches beyond the target directory where such a file is a symlink or a
hard link to one elsewhere:

- The key of a derived copy gets written to a new file, which then
  replaces it, instead of written through a symlink at its place.
- Lock files get copied to a new file before Nix rewrites them, instead
  of to flake.lock.populate, which a source may contain as a symlink.
- Before rsync syncs a source, each file with other hard links gets
  replaced by a copy of its own.  rsync fixes the mode and time of a file
  it takes for unchanged in place, which changes every hard link to it:
  one elsewhere, e.g. in /etc/nixos, or a backup's.
- Removing state makes only directories writable, which is what
  removing what's in them needs, instead of everything, including files
  that are hard links to ones elsewhere.
- The sentinel file only gets created if it's missing, instead of
  touched on every run.
- A link only counts as pointing into the store if its resolved path is
  in the store, so a link like /nix/store/../.. gets replaced.

Safety scenarios cover a symlink in place of a key, symlinks in a source
named like the lock file's copies, a hard link to a read-only file
outside in the target directory, and in stale state.

0 files changed, 0 insertions, 0 deletions