Windows receiver: rewrite names Windows would misread, skip what it can't store

[op-q]

Cross-platform plan, phase 1. Behaviour change, waiting for your review. Stacked on #69.

Problems this fixes (found by reading the code; Windows had never run it)

• A symlink in a folder aborted extraction on Windows at the first link. That covers most real project folders (node_modules/.bin, virtualenvs).
• Names that are ordinary on Linux and macOS mean something else to Windows:

Name sent	Windows would…	Now stored as
notes.txt:hidden	write an NTFS stream on notes.txt	notes.txt_hidden
mine.txt::$DATA	open mine.txt's main stream	mine.txt__$DATA
CON, nul.txt	open a device	CON_, nul_.txt
report. / notes	silently drop the dot or space	report_ / notes_
C:x	treat it as a drive-relative path	C_x
10:30 standup.md (from a Mac)	create a stream	10_30 standup.md

Design

• Rewrite, not refuse, because most of these names come from honest senders. A rewrite changes one component's spelling and never introduces a separator, so an entry cannot move to another directory. The existence and symlink checks run on the rewritten path, and every rename is shown as a warning. This is open question 1 of the plan, answered as it leaned.
• Archive paths are split on / by hand instead of going through Path, so every OS judges the same components. A backslash inside a component is refused everywhere.
• Warn and continue when the filesystem refuses a name (InvalidFilename/InvalidInput), or when a symlink can't be created. A full disk or a permission problem still aborts.
• On Windows, symlinks aren't attempted at all. With --force, trying would delete the existing file before failing to create the link.
• The policy is in the new cli/src/names.rs: pure functions tested on every OS. The single-file receive path uses it too (report:v2.pdf is saved as report_v2.pdf, and the receiver is told).

Tests (210 total, up from 193)

• 13 unit tests for the naming policy, plus 4 portable extractor tests that drive the Windows naming through the real extractor on Linux: rewriting, collisions after a rewrite, backslash refusal, and a filesystem-refused name.
• Negative control: with the old abort behaviour restored, the refused-name test fails.
• A Windows-only test with hostile names against a real NTFS destination. It checks that the receiver's existing file is untouched, no stream is created, and nothing is written outside the destination.
• A Windows-only skipped-symlink test, and a case-insensitive collision test for macOS and Windows.
• The Windows-only tests run in CI on this PR. They have not run on a real Windows machine; that's phase 5's manual checklist.

fmt, clippy -D warnings, cargo test --workspace --all-targets and check-secrets.sh all pass locally (Linux).

🤖 Generated with Claude Code

https://claude.ai/code/session_01G7Fy45hUvna94cd79WKG8S

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.