fix(extract): prevent raced symlink writes outside cwd

fix(extract): prevent raced symlink writes outside cwd #452