docs output writer: bind final writes to verified directory handles

Follow-up from #3049.

The docs output writer currently validates the session root and parent dev/ino before each write/rename and performs post-operation identity checks, but Node's cross-platform fs API does not expose openat/renameat-style operations that bind the final path operation to an already-open parent directory handle. A same-user concurrent parent rebind can therefore still win the final pathname-resolution window (O_NOFOLLOW only protects the leaf).

Scope for this issue:
- design a cross-platform directory-handle or native capability for final create/replace/restore operations;
- preserve Windows exFAT/network-share overwrite fallback;
- add race tests proving no bytes leave the session root.

Until this is delivered, #3049 keeps the existing fail-closed checks and post-write verification, but does not claim complete elimination of this OS-level TOCTOU window.

Start by tracing the docs output writer and the existing checks described as the follow-up from #3049. Design a cross-platform directory-handle or native capability for final create, replace, and restore operations, preserve the Windows exFAT/network-share fallback, and add race tests proving no bytes leave the session root.

Written by the indexing model from the issue text.