Fail closed on broken extension registries during template resolution

[Copilot]

Addresses both comments in review thread pullrequestreview-4865182104: a dangling extension .registry symlink still fails open, and canonical resolution keeps enumerating lower tiers after a higher-priority replace layer has already won.

ExtensionRegistry._load() — dangling symlink fail-open

• Path.exists() follows symlinks, so a dangling .registry symlink read as an absent registry, after which every on-disk extension directory was scanned as unregistered/enabled.
• Now detect the entry lexically and require a readable regular file before parsing; a broken symlink or directory at the registry path fails closed, raising the same errno open() would (ENOENT for a dangling symlink, EISDIR for a directory).

if not self.registry_path.is_symlink() and not self.registry_path.exists():
    return {"schema_version": self.SCHEMA_VERSION, "extensions": {}}
if not self.registry_path.is_file():
    code = errno.EISDIR if self.registry_path.is_dir() else errno.ENOENT
    raise OSError(code, "Extension registry is not a readable regular file",
                  str(self.registry_path))

PresetResolver.collect_all_layers() — priority parity

• Skip enumerating the extension tier once an effective replace base has already won at a higher tier (project override or a replace-strategy preset). The extension tier is the only lower-tier step that reads the extension registry, so a corrupt/unreadable one can no longer break init/constitution-sync materialization that a winning override or preset has already decided.
• Extensions are still enumerated when a higher composing layer (append/prepend/wrap) needs an extension-provided base; lower presets and the core layer remain collected for the diagnostic full chain.

Tests

• Fail-closed coverage for dangling-symlink and directory extension registries.
• collect_all_layers/resolve_content remain robust to a broken extension registry when a replace preset wins.

[Copilot]

Copilot wasn't able to review any files in this pull request.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.