fn child_directory(parent: &File, name: &str, create: bool) -> Result<File>
Every traversal is descriptor-relative and rejects symlinks atomically. Holding descriptors also prevents a renamed ancestor redirecting writes.