fix: drop the check-then-use file access in the stub-tar test

CodeQL flagged js/file-system-race (high) on the test: existsSync + statSync +
readFileSync on the same path is a time-of-check-to-time-of-use race. Read the
file once and assert on the buffer instead (readFileSync throws if missing,
length covers the size check, the first two bytes are the gzip magic). Same
assertions, one access, no race.

Note: AI-assisted (Claude Code). Manually verified: the 3 stub-tar tests pass,
eslint and prettier clean, and no existsSync/statSync remain on the path so the
CodeQL check-then-use pattern is gone.

Author: notluquis

test/unit/stub-env-tar.test.ts

@@ -24,13 +24,14 @@ describe('createStubEnvTar', () => {
     // Act
     const returned = createStubEnvTar(out);
 
-    // Assert
+    // Assert. Read once (readFileSync throws if it is missing) and assert on the
+    // buffer, instead of existsSync + statSync + readFileSync which is a TOCTOU
+    // race on the same path.
     expect(returned).toBe(out);
-    expect(fs.existsSync(out)).toBe(true);
-    expect(fs.statSync(out).size).toBeGreaterThan(0);
-    const header = fs.readFileSync(out).subarray(0, 2);
-    expect(header[0]).toBe(0x1f);
-    expect(header[1]).toBe(0x8b);
+    const content = fs.readFileSync(out);
+    expect(content.length).toBeGreaterThan(0);
+    expect(content[0]).toBe(0x1f);
+    expect(content[1]).toBe(0x8b);
   });
 
   it('packs the STUB_FOR_E2E marker file into the tarball', () => {