refactor: modularize audit and harden build validation

audit/internal/app/support_bundle.go

@@ -455,11 +455,21 @@ func BuildSupportBundle(exportDir string) (string, error) {
 
 	now := time.Now().UTC()
 
-	stageRoot := filepath.Join(os.TempDir(), fmt.Sprintf("bee-support-stage-%s-%s", sanitizeFilename(hostnameOr("unknown")), now.Format("20060102-150405")))
+	// Stage under a private parent dir. Two bundle builds started in the same
+	// wall-clock second (two operators, or an on-demand build racing the
+	// blackbox worker) must not share a staging tree: one's deferred
+	// os.RemoveAll would then wipe the other's half-populated tree and yield a
+	// truncated archive. The leaf name stays meaningful because it becomes the
+	// archive's top-level directory.
+	buildParent, err := os.MkdirTemp(os.TempDir(), "bee-support-build-")
+	if err != nil {
+		return "", err
+	}
+	defer os.RemoveAll(buildParent)
+	stageRoot := filepath.Join(buildParent, fmt.Sprintf("bee-support-stage-%s-%s", sanitizeFilename(hostnameOr("unknown")), now.Format("20060102-150405")))
 	if err := os.MkdirAll(stageRoot, 0755); err != nil {
 		return "", err
 	}
-	defer os.RemoveAll(stageRoot)
 
 	if err := categorizeExportTree(exportDir, stageRoot, true); err != nil {
 		return "", err
@@ -513,10 +523,6 @@ func SupportBundleBaseName(at time.Time) string {
 	return fmt.Sprintf("%s (BEE-SP v%s) %s %s %s", date, ver, model, sn, tod)
 }
 
-func LatestSupportBundlePath() (string, error) {
-	return latestSupportBundlePath(os.TempDir())
-}
-
 func cleanupOldSupportBundles(dir string) error {
 	matches, err := filepath.Glob(filepath.Join(dir, supportBundleGlob))
 	if err != nil {
@@ -538,18 +544,6 @@ func cleanupOldSupportBundles(dir string) error {
 	return nil
 }
 
-func latestSupportBundlePath(dir string) (string, error) {
-	matches, err := filepath.Glob(filepath.Join(dir, supportBundleGlob))
-	if err != nil {
-		return "", err
-	}
-	ordered := orderSupportBundles(supportBundleEntries(matches))
-	if len(ordered) == 0 {
-		return "", os.ErrNotExist
-	}
-	return ordered[0], nil
-}
-
 func supportBundleEntries(matches []string) map[string]time.Time {
 	entries := make(map[string]time.Time, len(matches))
 	for _, match := range matches {
@@ -758,24 +752,6 @@ func buildCommit() string {
 	return strings.TrimSpace(string(raw))
 }
 
-func copyDirContents(srcDir, dstDir string) error {
-	entries, err := os.ReadDir(srcDir)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil
-		}
-		return err
-	}
-	for _, entry := range entries {
-		src := filepath.Join(srcDir, entry.Name())
-		dst := filepath.Join(dstDir, entry.Name())
-		if err := copyPath(src, dst); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
 func copyDirContentsFiltered(srcDir, dstDir string, keep func(rel string, info os.FileInfo) bool) error {
 	entries, err := os.ReadDir(srcDir)
 	if err != nil {