install: TOCTOU symlink race (unlink-then-create without O_EXCL) allows arbitrary file overwrite (CVE-2026-35355) | HOL Guard CVE