test(filelock): mirror relative-root rename admission

Problem: the rooted-lock rename regression failed on Windows before reaching
the lock operation.

Root cause: Go's direct os.OpenRoot uses a Windows handle without delete
sharing, while production opens the lock directory relative to its managed
Root using an Openat handle with delete sharing. The fixture conflated them.

Fix: open the test directory through its parent Root, matching the production
constructor. Retain the real rename/replacement and physical lock-location
assertions on every platform. Document the direct-root Windows limitation.
No production code, timeout or platform skip changes.

Verification: complete filelock race (25 passes), Windows amd64 compilation,
required builtin/boot, root vet, full lint and make check. The prior full root
qualification is retained separately; new hosted Windows evidence is pending.

docs/ISOLATION_OPERATION_LEASE_SECURITY.md

@@ -39,9 +39,12 @@ The utility adds `AcquireRoot` and `TryAcquireRoot` for an `os.Root` plus a loca
 name. They reject nonlocal names and nonregular lock files, preserve file bytes
 and modes, and never reopen a filename by concatenating `Root.Name()`.
 
-Relative opens follow the opened directory after a rename. Outside symlinks are
-refused by `os.Root`. Closing the directory handle does not release an admitted
-file lease. Existing path APIs keep their global-path and wait-budget contracts.
+Relative child-directory opens follow the opened directory after a rename.
+Windows may forbid renaming a directory opened directly with os.OpenRoot;
+the result owner uses a child handle. Outside symlinks are refused by os.Root.
+
+Closing the directory handle does not release an admitted file lease.
+Existing path APIs keep their global-path and wait-budget contracts.
 
 ## Lifecycle coverage
 

internal/base/filelock/root_test.go

@@ -178,7 +178,13 @@ func TestRootedLockFollowsTheOpenedDirectoryAfterRename(t *testing.T) {
 	if err := os.Mkdir(dir, 0o700); err != nil {
 		t.Fatal(err)
 	}
-	root, err := os.OpenRoot(dir)
+	parentRoot, err := os.OpenRoot(parent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer parentRoot.Close()
+	// Match resultLockRoot: a relative child handle permits Windows rename.
+	root, err := parentRoot.OpenRoot("original")
 	if err != nil {
 		t.Fatal(err)
 	}