Function remove_file_beneath 

pub fn remove_file_beneath(root: &Path, rel: &Path) -> Result<(), Error>

Confined unlink of a root-relative file (#77): opens the parent under RESOLVE_BENEATH and unlinkats the leaf, so a swapped-in symlink parent can’t redirect the delete outside root.