## Why
Renaming a writable directory could move protected descendants outside the
paths covered by their read-only or unreadable policy entries.
## What changed
- Deny unlink-style writes to directory ancestors of protected paths, placing
these rules after broader write allowances in the generated Seatbelt policy.
- Apply full write denies to unreadable glob matches and protect their directory
ancestors against renames.
- Support brace alternation and backslash escapes when translating filesystem
globs into Seatbelt regular expressions.
## Testing
Add coverage for ancestor rename attempts across explicit read-only and deny
entries, multiple glob forms, canonicalized glob paths, and the new glob syntax.
GitOrigin-RevId: edfda9d4c2bc7ba2ecd6b67744446871e526084f
Dylan Hurd
52e387daca