Sandbox write-path restore skips symlinks pointing outside expected location

On Linux sandboxing, restoring bind-mounted write paths now resolves symlinks with realpathSync first. If a symlink's resolved target differs from the expected location and points outside it, the path is skipped (with a log message: "Skipping write-path restore for symlink pointing outside expected location") instead of being blindly re-bound.