## Why
An `apply_patch` path can be replaced with a symlink after verification, allowing an unsandboxed patch operation to reach a different file than the one that was approved.
## What changed
- Add `follow_symlinks` options to executor filesystem reads, writes, metadata lookups, directory creation, and removal, including the corresponding `followSymlinks` protocol fields.
- Implement no-follow filesystem operations on Unix and Windows that reject links in any path component and restrict file access to regular files.
- Run `apply_patch` with symlink traversal disabled when an otherwise-required sandbox is bypassed, while retaining the existing follow-symlink default for standalone callers.
## Testing
- Cover leaf and ancestor symlinks across patch add, update, delete, and move operations, including a path swap after verification.
- Exercise local and remote no-follow filesystem behavior, concurrent directory creation, special-file rejection, and Windows reparse points.
GitOrigin-RevId: 43fd479084891493ce13564fbd894b98f329c6dd
## Why
Updating a file with `apply_patch` historically normalized its contents to LF,
which can rewrite line endings outside the requested change.
## What changed
- Add an opt-in `PreserveLineEndings` update mode and thread it through patch
verification, application, and the standalone executable. Existing APIs keep
the LF-normalizing mode by default.
- Retain the original endings of untouched and context lines, including in
mixed-ending files, and use the file's first line ending for inserted or
replaced lines.
- Track patch context separately from identical changed lines so preservation
does not alter replacement ordering or matching.
## Testing
Add coverage for CRLF, CR, mixed endings, trailing blank lines, repeated lines,
EOF overlap rejection, and legacy LF normalization.
GitOrigin-RevId: 085f0cbc57e0965aa62c6a2d0e80870424e762f5
pakrym-oai