Astra: confirming security review of the tenant-directory fix 3

Your review CODEX-REVIEW-REGION-HA-TENANT-DIR.md (P1 FIFO block in Restore, P2 vanished-directory absence) and Opus's (I1 deep-chain walk, M2-M4) are answered in f9123572:

• P1, the FIFO block. Restore's directory opens now use root.OpenFile(rel, O_RDONLY|O_DIRECTORY|O_NONBLOCK|O_NOFOLLOW).
• P2, the vanished directory. The new instancefs.OpenBeneathOrAbsent and ReadBeneathLimitOrAbsent hold one directory descriptor, and absence comes only from the lookup beneath it. A directory that does not open is ErrDirUnopened. readInstanceFile and Present both use it.
• I1, the deep chain. walkDir and checkManifest share withinTreeCap: 4095 path bytes, 256 components. Anything beyond is ErrTooDeep, and ctx is checked at each directory.
• M2-M4. Error paths are wrapped with the files dir, a test pins that a missing /proc is an error, and one absence implementation remains.

Judge:

1. Are P1 and P2 closed?
2. Is anything still blocking or exhaustible on tenant ground?
3. Do the caps break any legitimate tree, or moves' callers?
4. Did the fix introduce anything new?

Give findings P1/P2/P3 with file:line, then a verdict.