fix: resolve symlinks before path validation

[Baqauye]

Summary

Resolve filesystem paths with fs.realpath() before validating them with assertWithinDir() during task origin verification.

Thesis

Other filesystem operations in this module, such as createDeterministicTarball() and getAllFilesRecursively(), already resolve symlinks before validating paths. This change makes the verification flow consistent by validating canonical filesystem paths.

Changes

• Resolve taskFolderPath before validation.
• Resolve signatureFile before validation.
• Apply the same behavior in:
  • buildAndValidateSignature()
  • verifyTaskOrigin()

Diff

- assertWithinDir(taskFolderPath, allowedDir);
- assertWithinDir(signatureFile, allowedDir);

+ const resolvedTaskFolderPath = await fs.realpath(taskFolderPath);
+ const resolvedSignatureFile = await fs.realpath(signatureFile);
+
+ assertWithinDir(resolvedTaskFolderPath, allowedDir);
+ assertWithinDir(resolvedSignatureFile, allowedDir);

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2