Fix file search symlink escape (#8667)

[Sprengmeister-dev]

Title: Fix file search symlink escape (#8667)

What

• Skip traversing symlinks that resolve outside the search root, preventing file search from escaping the workspace.
• Add a regression test for symlink escapes.

Why

• The file search could follow symlinks out of the workspace, violating sandbox expectations on Windows and other platforms.

How

• Canonicalize the search root and compare each symlink’s resolved target to it; skip entries outside.
• Add a unit test that creates a root + outside directory and asserts the outside file is not returned.

Issue

• Codex escapes its sandbox #8667

Tests

• just fmt
• cargo test -p codex-file-search
• just fix -p codex-file-search

I have read the CLA Document and I hereby sign the CLA

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[Sprengmeister-dev]

I have read the CLA Document and I hereby sign the CLA

[Sprengmeister-dev]

recheck