fix: create the audit log 0600 in a 0700 directory and refuse symlinks (SEC-11)

src/aegis_gitea_mcp/transports.py

@@ -8,6 +8,7 @@ actionable message on stderr (never on stdout, which carries JSON-RPC on stdio).
 from __future__ import annotations
 
 import asyncio
+import errno
 import logging
 import sys
 import time
@@ -428,7 +429,9 @@ def _audit_startup_error(settings: Settings) -> str | None:
     try:
         get_audit_logger()
     except OSError as exc:
-        reason = exc.strerror or type(exc).__name__
+        reason = exc.strerror or str(exc) or type(exc).__name__
+        if exc.errno == errno.ELOOP:
+            reason = "the path is a symbolic link, which is refused"
         return (
             f"cannot open the audit log {settings.resolved_audit_log_path} for append "
             f"({reason}). Fix the permissions or point AUDIT_LOG_PATH (or DATA_DIR) at a "