fix(path-validation): resolve symlinks in assertWithinDir

[Sertug17]

path.resolve() does not follow symbolic links. If a symlink exists inside
the allowed directory pointing outside (e.g., deployments/mainnet/link → /etc),
assertWithinDir passes the check but subsequent file reads access the external path.

Replace path.resolve() with fs.realpathSync() to resolve symlinks before
validating the path boundary. This matches the pattern already used correctly in
task origin validate.ts (which calls fs.realpath() before assertWithinDir).

Affected callers that now get symlink protection:
- install-deps/route.ts:56
- upgrade-config/route.ts:49
- validation-service.ts:37,41,124,129
- state-diff.ts:90

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2