bregctl refuses symlinked destinations such as macOS /tmp without naming the symlink

Found while writing the public tutorial `Review BReg changes in Casework`.

## What Happened

`bregctl dev export-client --output ` refused a destination under `/tmp` on macOS:

```
path traverses a symbolic link
```

`/tmp` is a symlink to `/private/tmp` on macOS, so any temporary directory fails. `bregctl init` refuses the same destinations for the same reason (`crates/registry-bregctl/src/safe_path.rs`).

## Expected Behavior

If refusing symlinked paths is deliberate (it looks like a safety rule for files holding credentials), the message should name the component that is a symlink and the resolved path, so a macOS reader knows to use `/private/tmp` or a directory under `$HOME`. If it is not deliberate, canonicalise the destination parent before the check.

## Environment

Registry Stack 0.30.0 release binaries, macOS.

Triage: later.

Start with crates/registry-bregctl/src/safe_path.rs and reproduce the failure using bregctl dev export-client and bregctl init with a destination under macOS /tmp. Determine whether rejecting symlinked paths is intentional; done means either the error names the symlink and resolved path, or the destination parent is canonicalised before checking.

Written by the indexing model from the issue text.