Prevent std imports from escaping the standard-library root

## Current evidence

`front/parser/src/import.rs` confines local imports to their canonical module directory and external imports to their canonical dependency package root. `std_import_unit`, however, converts the text after `std::` with `replace("::", "/")`, joins it to the std root, checks only that the resulting path is a file, and then parses the canonicalized target.

That leaves std imports without the equivalent containment check. Traversal components or a symlink inside the installed std tree can resolve to a `.wave` file outside the standard-library root.

## Scope

- Reject std import paths containing traversal or otherwise invalid module segments.
- Canonicalize the std root and selected import target before parsing.
- Require the canonical target to remain inside the canonical std root, including through symlinks.
- Preserve valid `std::foo::bar` imports and the existing compatibility-revision validation.
- Return a normal Wave diagnostic instead of allowing an escaped file to be parsed.

## Completion criteria

- Tests cover a normal std import, a traversal attempt, and a symlink that resolves outside the std root.
- Escaping imports fail before parsing the outside file.
- Valid installed std imports continue to work unchanged.

Start in front/parser/src/import.rs at std_import_unit and compare its path handling with the local and external import containment checks. Add coverage for a normal std import, traversal, and a symlink escaping the std root; done means escaped imports produce a normal Wave diagnostic before the outside file is parsed while valid imports and compatibility-revision validation remain unchanged.

Written by the indexing model from the issue text.