Function load_or_generate_node_key 

pub fn load_or_generate_node_key(
    runtime_dir: &Path,
) -> Result<SigningKey, NodeKeyError>

Load <runtime_dir>/node.key, creating it (mode 0600) if absent. The runtime dir is created too.

Creation is race-free where the filesystem allows: the seed is written to a private temp file in the same directory, then hard-linked to node.key. The link fails if the target already exists (create_new semantics), and a reader never sees a partially written key. On filesystems without hard links (exFAT, some network mounts) it falls back to create_new + write, and readers retry briefly on a zero-length file. Stale temp files (they hold the seed) are removed on entry.