fix(core): keep launchd service logs outside protected Downloads

tests/test_launchd_logs.py

@@ -0,0 +1,31 @@
+import stat
+from pathlib import Path
+
+import pytest
+
+from k1link.launchd_logs import launchd_log_path, prepare_launchd_log
+
+
+def test_journal_is_private_and_keeps_existing_evidence(tmp_path, monkeypatch):
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+    path = launchd_log_path("core.log")
+    prepare_launchd_log(path)
+    path.write_text("existing evidence\n")
+    prepare_launchd_log(path)
+    assert path.read_text() == "existing evidence\n"
+    assert stat.S_IMODE(path.stat().st_mode) == 0o600
+    assert path == tmp_path / "Library/Logs/NODE.DC/MissionCore/core.log"
+
+
+def test_journal_rejects_symlink_and_unexpected_destination(tmp_path, monkeypatch):
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+    target = tmp_path / "evidence"
+    target.write_text("immutable")
+    path = launchd_log_path("core.log")
+    path.parent.mkdir(parents=True)
+    path.symlink_to(target)
+    with pytest.raises(OSError):
+        prepare_launchd_log(path)
+    with pytest.raises(ValueError):
+        prepare_launchd_log(tmp_path / "Downloads/core.log")
+    assert target.read_text() == "immutable"