ScpLocalFile.createExclusive

Creates a private staging file in the destination parent.

The destination is resolved one component at a time from a parent directory the caller trusts: every intermediate directory is opened with openat and O_NOFOLLOW, so a swapped or symlinked parent component cannot redirect the creation. The final parent must be owned by the effective user and must not be group/world writable. This makes ownership of the staging name enforceable for its full lifetime.