Filesystem: fail closed on symlink traversal outside configured roots

Problem

Path validation can become ambiguous across symlink hops, allowing access attempts to resolve outside configured filesystem roots.

Why now

Filesystem roots are the primary safety boundary for the reference filesystem server. Symlink traversal ambiguity can quietly break that boundary.

Current insufficiency

There is path validation coverage, but no explicit deterministic reason-coded contract proving that symlink-based escapes are denied before any partial read/write behavior.

Expected behavior

• Requests that resolve through symlinks outside allowed roots fail closed.
• Denials are deterministic and machine-classifiable.
• No partial file reads/writes occur when traversal is rejected.

Validation requirements

• Add regression tests for symlink escape paths.
• Assert denial classification and stable response behavior.
• Verify no content is returned for denied paths.

Scope map

• src/filesystem/path-validation.ts
• src/filesystem/path-utils.ts
• src/filesystem/index.ts
• src/filesystem/__tests__/path-validation.test.ts

Start with src/filesystem/path-validation.ts and src/filesystem/path-utils.ts, then inspect the filesystem entry point in src/filesystem/index.ts and the existing tests in src/filesystem/tests/path-validation.test.ts. Add regression coverage for symlink escapes, deterministic denial classification, stable responses, and the absence of returned content or partial file operations when access is rejected.