split: harden output open path against TOCTOU target swaps

[can1357]

uutils split checks input/output identity by path before opening the output and then opens with truncation, leaving a race window open on mutable path components. GNU opens first and compares the opened output inode against input before truncation.

Reproduction Steps

Omitted due to nondeterministic TOCTOU

Impact

The race can cause split to truncate/write a file different from the one validated, including the input file or another file the process can access.

[codspeed-hq]

Merging this PR will improve performance by 3.16%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
✅ 297 untouched benchmarks
⏩ 48 skipped benchmarks¹

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
⚡	Simulation	split_bytes	429.8 µs	416.7 µs	+3.16%

---

_{Comparing can1357:split-harden-output-open-path-against-toctou-target-swaps (23b354d) with main (ef8e45c)}

Footnotes

1. 48 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩