[itlezy]

The Rust platform CI consumer now uses the current Builder source fence. On Linux, its musl and Android jobs stop before compilation because the pinned MiniUPnP checkout contains tracked file symlinks such as minissdpd/LICENSE -> ../LICENSE; the material-input hasher applies managed-worktree redirect rejection to those ordinary upstream inputs.

Keep Rust sources, admitted native roots and directory ancestors strict. For subsequent native input roots only, accept actual links recorded with Git mode 120000 when their bounded relative target is a regular, nonredirected file inside the same root. Verify strict literal traversal agrees with the admitted target and require each literal ancestor to exist without redirection, so lexical redirect/.. or missing/.. cannot hide different material. Hash the link spelling and target bytes. Untracked/dirty regular-file replacements, external or absolute targets, dangling links, directory links, cycles and redirected ancestors remain refused. Upstream checkouts are unchanged.

Focused real-link regressions are included in both existing Windows and Linux hosted unit selections. Normal commit/push privacy, hygiene and actionlint passed; the normal fast push ran 36 tests with zero failures or skips, including actual Windows file symlinks and the existing isolated synthetic Cargo A/B rebuild proof. Linux-hosted symlink and remaining baseline proof are pending the corrected exact head of this PR.

Parent-coordinated parallel delivery: packaging PR #52 owns disjoint provisioning and package-identity functions. This prerequisite fixes Rust PR emulebb/emulebb-rust#314; the consumer will pin the actual merged Builder revision before its fresh hosted matrix.

Refs emulebb/emulebb-rust#293 and #37.