brokerd: refuse / and a symbolic link as a socket's directory

brokerd makes a socket's directory 0700. With a socket directly in / it would
chmod /, and through a symbolic link it would change the link's target. Both
are now refused at start with #brokerd-start-failed. Without the fix the link
case started and served, with the shared directory made private.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/runbook.md

@@ -182,6 +182,10 @@ programs off it.
 - `cannot prepare <dir>: …` — the directory cannot be made or `chmod`ed:
   `ls -ld <dir> "$(dirname <dir>)"`. A path that runs through a file, or a directory owned by
   another user, gives this.
+- `cannot prepare <socket or dir>: a socket needs a directory of its own` or `…: is a symbolic
+  link or not a directory` — `brokerd` makes a socket's directory 0700, so it refuses `/` and a
+  directory reached through a link (the link's target would be changed instead). Give each socket
+  its own real directory, as the defaults under `$BOXMAKER_HOME/run/` are.
 - `cannot listen on <socket>: …` — `path must be shorter than SUN_LEN` means the socket path is
   longer than 107 bytes; `Address already in use` means something still listens there
   (`ss -xlp | grep <socket>`).