Replace planted policy directory symlinks instead of following them

install -d follows a managed or distribution symlink and would chmod the target. Unlink those paths first, and treat a dangling symlink as a directory the migration still has to repair.

migrations/1787515927.sh

@@ -7,7 +7,7 @@ browser_policy_grant_user "${USER:-$(id -un)}"
 
 repaired=0
 for dir in "${BROWSER_POLICY_MANAGED_DIRS[@]}"; do
-  [[ -d $dir ]] || continue
+  [[ -d $dir || -L $dir ]] || continue
   if browser_policy_dir_hardened "$dir" && browser_policy_parents_hardened "$dir"; then
     continue
   fi
@@ -20,9 +20,9 @@ if (( repaired )); then
 fi
 
 for dir in "${BROWSER_POLICY_FIREFOX_DIRS[@]}"; do
-  [[ -d $dir ]] || continue
+  [[ -d $dir || -L $dir ]] || continue
   browser_policy_firefox_hardened "$dir" && continue
-  as_root install -d -m 0755 -o root -g root "$dir"
+  browser_policy_setup_parent "$dir"
   browser_policy_purge_dir "$dir"
   if ! browser_policy_firefox_policy_file_ok "$dir/policies.json"; then
     browser_policy_install_firefox_policies "$dir"