ruvector-context: macOS extended ACLs bypass the private-root check (doc or detection)

Follow-up from the PR #902 security review (LOW, non-blocking — #902 merged at 682e1c75).

Reproduced

On macOS, granting an NFSv4-style extended ACL on an otherwise-private root:

chmod +a "everyone allow read,write,execute,search,add_file,add_subdirectory,delete_child" <root>

gives every user on the box add_file and delete_child — i.e. full name-substitution power inside the index root — while symlink_metadata().mode() still reads 0700 and ScopedContextIndex::open() accepts it.

That is precisely the root-write capability the design states must be impossible. With it, the name-substitution attacks that rounds 1–4 of the review closed become reachable again.

Platform scope

macOS / NFSv4-ACL specific. On Linux, POSIX ACLs fold into the mode's group bits through the mask, so the existing mode & 0o077 != 0 check catches them.

Severity: LOW, and why

An attacker cannot set that ACL themselves — only the owner or root can. So this is a misconfiguration the check fails to detect, not an attacker-reachable escalation. It belongs in the same category as the operator error that the crate's retained defence-in-depth (staging directory, inode identity check, lone-regular-file requirement, reserved-name sweep) is documented to cover.

Fix — narrow the claim, or read the ACL

The crate currently says it "refuses a root other users can reach." On macOS what it actually refuses is a root whose mode bits say so. Either:

• Cheap and honest: add a sentence to the crate docs and ADR-334 invariant 10 stating that mode-based detection does not see extended ACLs on macOS, so operators must not grant them on the index root; or
• Complete: read the ACL (e.g. acl_get_file) on macOS and refuse a root carrying entries that grant non-owner access.

The documentation fix is probably the right first move given the misconfiguration-only reach — it keeps the stated guarantee true, which is the property that matters.

Start with the crate documentation and ADR-334 invariant 10, which describe the private-root guarantee and mode-based check. Document that extended ACLs on macOS are not detected and must not be granted on the index root. Done means the stated guarantee is narrowed consistently without changing the ACL detection implementation.