symlink-harden: prevent recursion