The guard's behaviour is more platform-dependent than most of this
codebase, and Windows was the platform not exercising it. Go maps a
symlink reparse point to ModeSymlink, which the guard keys on, but a
directory junction maps to ModeIrregular instead — the walk still refuses
to descend one, because Go treats both as name surrogates and withholds
ModeDir, so that difference is safe rather than a hole. Path case is the
other divergence: evalSymlinks normalises it on Windows, which is what
lets the containment test compare a resolved target against a resolved
root without a case-folding step of its own.
None of that was covered by an executing test. The Windows job deliberately
skips the full suite, so this adds only the guard's own package — pure Go,
no cgo, a fraction of a second — alongside the agent and sidecar tests
already there for the same reason.
Symlink creation on Windows needs SeCreateSymbolicLinkPrivilege, so the
tests skip rather than fail when the host will not grant it; on every other
platform a failure to create one stays a hard error.
Andrey Kumanyaev
b7336a9ad9