Path Containment Security Overhaul

The system that prevents worktree-isolated agents from writing outside their assigned worktree has been substantially rewritten to handle complex path forms that could previously bypass containment.

New protections:

• UNC shares (Windows \\server\share paths) are detected and blocked when the session root is local
• /net/ automount paths (Linux/macOS NFS automounts) are recognized and normalized
• Apple /System/Volumes/Data/ paths are remapped to their real root
• Paths with raw dot-segments that survive path.normalize are blocked
• Windows paths with trailing dots or spaces (a Windows security concern) are detected
• Device namespace paths (\\?\) are unwrapped or blocked as appropriate
• Symlink resolution now iterates up to 8 rounds to reach a stable canonical form

Error messages are more specific. For example, a network-shaped path against a local checkout says: > This write was blocked because the path is network-shaped (a UNC share or /net automount spelling) while this session's checkout is local.

A path that can't be safely resolved says: > This write was blocked because the path is spelled in a form that cannot be safely resolved (for example through a symlink storing a raw dot segment, a network-share or device-namespace shape, or an unreadable ancestor directory).

Commands run by worktree-isolated agents now get a more specific rejection if their working directory resolves outside the worktree due to letter-case mismatch: "(this path differs from the registered spelling only by letter case — respell it to match exactly)".