fix: resolve dangling symlinks during MCP roots path validation

[mohammadmseet-hue]

What

Harden MCP roots path validation against dangling symlinks in resolveCanonicalPath() (src/utils/files.ts), used by McpContext.validatePath() to keep file-writing tools inside the configured workspace roots.

Problem

For a not-yet-existing output path, resolveCanonicalPath() walks up to the nearest existing ancestor, canonicalizes it with fs.realpath(), and re-appends the missing trailing segments.

fs.realpath() reports a dangling symlink (a symlink whose target does not exist yet) as ENOENT. The walk then treated the link's own name as an ordinary missing segment and appended it verbatim, so the returned canonical path stayed inside the root even though the link points outside it. saveFile() writes to the original unresolved path, the write follows the symlink, and the file lands outside every configured root. This gap remained after the earlier hardening in #2127 and #2269.

Fix

In the ENOENT branch, lstat() each candidate component. If it is itself a symlink, resolve its target with readlink and continue canonicalization from the target. The returned canonical path now reflects the real write destination, so validatePath() rejects out-of-root targets. A MAX_SYMLINK_DEPTH = 40 guard (mirrors SYMLOOP_MAX) bounds symlink cycles among not-yet-existing targets.

Tests

Adds two unit tests to tests/utils/files.test.ts:

• a dangling symlink at the leaf resolves to its target, not its in-tree path;
• a dangling intermediate directory symlink resolves the final path through the link target.

node --test build/tests/utils/files.test.js passes; prettier --check and eslint are clean on both files.