SECURITY UPDATE: path traversal when creating intermediate directories
debian/patches/CVE-2026-53785.patch: add do_mkdir_at() in syscall.c and
route make_path() through it, so each missing directory is created
relative to a parent walked one component at a time with O_NOFOLLOW
instead of a plain mkdir() on the full path