Agent memory reads are now protected against symlink escapes

What

Agent memory (the MEMORY.md entrypoint and its directory) is now checked before being read:

• If the entrypoint is a symlink or another special file rather than a regular file, it's refused
• If the entrypoint or its directory resolves outside the working copy, or through a dangling or otherwise unresolvable link, it's refused too

In all these cases, Claude Code skips the read and logs a telemetry event instead of silently following the link.

Why

Without this check, a symlink inside the working copy could point to files elsewhere on disk, letting memory reads escape the project directory. This closes that path while keeping normal, in-project memory files working as before.