Fix debug log file race

[svy04]

Summary

• Replace path-level stat(debugLogPath) with fd.stat() after opening the debug log, so /debug tails the same file handle it inspected.
• Add an isolated Bun regression test that mocks fs/promises and fails if path stat is used before open.

Evidence boundary

This is one local remediation for the CodeQL js/file-system-race queue item. It does not claim the hosted alert is closed until GitHub code scanning re-runs on the branch/default branch.

Primary references used: CodeQL js/file-system-race, Node.js FileHandle.stat/read, and CWE-367 TOCTOU guidance.

Verification

• bun test src\skills\bundled\debug.test.ts
• bun test src\skills\bundled\debug.test.ts src\skills\bundled\loop.test.ts src\skills\bundled\updateConfig.test.ts
• bun run typecheck --pretty false
• bun run product:github-hosted-trust-posture (RISKS_RECORDED; readiness claims remain blocked)
• bun run product:code-scanning-remediation-queue
• bun run product:public-claim-boundary
• bun run product:evidence-manifest
• bun run verify:privacy
• bun run build
• bun run product:quality (exit 0; terminal condition still records the local VS Code CLI unavailable boundary)
• git diff --check

Note: running product:quality refreshed generated product-quality reports locally; this PR intentionally commits only the code/test remediation.