fix: preserve snapshot symlinks and guard incomplete upgrade copies

internal/api/snapshot_download_test.go

@@ -192,15 +192,39 @@ func TestSnapshotDownloadRejectsUnsafeAndForeign(t *testing.T) {
 	if w.Code != 404 {
 		t.Fatal(w.Code)
 	}
-	for _, target := range []string{"../home", "/etc/passwd", "../../elsewhere"} {
+	for _, target := range []string{"../home", "/workspace/example", "../../elsewhere", "missing", "link"} {
 		if err := os.Symlink(target, filepath.Join(dir, "link")); err != nil {
 			t.Fatal(err)
 		}
 		w = httptest.NewRecorder()
 		a.snapshotDownload(w, httptest.NewRequest("GET", "/?download="+id, nil), i)
-		if w.Code != 400 || w.Header().Get("Content-Disposition") != "" {
+		if w.Code != 200 || w.Header().Get("Content-Disposition") == "" {
 			t.Fatal(target, w.Code)
 		}
+		gz, err := gzip.NewReader(w.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+		tr := tar.NewReader(gz)
+		found := false
+		for {
+			h, err := tr.Next()
+			if err == io.EOF {
+				break
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			if h.Name == "link" {
+				found = h.Typeflag == tar.TypeSymlink && h.Linkname == target && h.Size == 0
+			} else if h.Name != "./" {
+				t.Fatalf("unexpected archived entry: %s", h.Name)
+			}
+		}
+		gz.Close()
+		if !found {
+			t.Fatal("link text was not preserved")
+		}
 		if err := os.Remove(filepath.Join(dir, "link")); err != nil {
 			t.Fatal(err)
 		}