fix(reference): reject FIFO replacements without blocking

Use the shared nonblocking, no-follow regular-file opener at the source-read boundary and report a nonregular replacement as changed. Keep descriptor identity and extent checks.

The compiled subprocess regression timed out on the baseline and completes without a FIFO writer after this change. Reference reader failure, capacity, cancellation, and import checks pass.

src/reference/ReferenceSourceReaderFile.ts

@@ -1,8 +1,12 @@
 import type { BigIntStats } from "node:fs";
-import { constants } from "node:fs";
-import { open, type FileHandle } from "node:fs/promises";
+import type { FileHandle } from "node:fs/promises";
 import { dirname } from "node:path";
 
+import {
+  NonRegularFileReadError,
+  openRegularFile,
+} from "../filesystem/RegularFile.js";
+
 import {
   entryFailure,
   filesystemFailureDetail,
@@ -209,7 +213,7 @@ export const readStableFile = async (
         parentBefore.message,
         safeSize(expected.size),
       );
-    handle = await open(absolute, constants.O_RDONLY | constants.O_NOFOLLOW);
+    handle = await openRegularFile(absolute, { symlinks: "reject", signal });
     const prepared = await prepareFileRead(request, handle);
     if (prepared.status === "failed") return prepared.entry;
     const contents = await readFileContents({
@@ -240,6 +244,14 @@ export const readStableFile = async (
         "File read cancelled",
         safeSize(expected.size),
       );
+    if (cause instanceof NonRegularFileReadError)
+      return entryFailure(
+        path,
+        "file",
+        "changed",
+        "File is no longer a regular file",
+        safeSize(expected.size),
+      );
     const message = filesystemFailureDetail(
       cause,
       "File could not be read safely",