harden-symlink: be more paranoid about copying nameidata