harden-symlink: handle LAST_BIND case