Permission checks now handle unresolved symlink chains and re-check paths for Edit/NotebookEdit

What

• The core read/write permission-decision function now takes a richer path-resolution object with a spellings set and an unresolved flag; when a path's symlink chain can't be resolved, it now explicitly denies with a dedicated reason instead of silently falling through, and still honors blockReadsOutsideWorkingDirectories and restricted-mode circuit breakers.
• The permission stash used for later prompt dedup/matching now stores the path's spellings set instead of the whole path-resolution object.
• checkPermissions for the Edit and NotebookEdit tools no longer returns the base permission decision directly; it now only short-circuits on an explicit deny, and otherwise runs an extra check against the stashed path/spellings that can override an allow/ask decision.

Why

This closes a gap where a path whose symlink chain couldn't be resolved could otherwise be treated as safe, and makes sure Edit/NotebookEdit re-check the resolved path before allowing an operation.