test(apm): stabilize temporary path containment

[artiphishle]

Closes #602

Summary

• canonicalize the extracted packed-package root before containment checks
• cover a symlinked temporary-root path so lexical and realpath forms differ on every platform
• retain traversal, symlink-escape, archive-prefix, and retained-artifact regression coverage

Architecture

The release-validation adapter continues to use resolvePathWithinRoot; it now supplies a canonical extracted-root boundary that matches canonicalized candidate paths.

Validation

• bun test src/features/apm-release-validation/apmRelease.test.ts
• bun run build
• bun run check-types
• bun run lint (42 existing warnings; no errors)
• bun run knip:check (one existing configuration hint)
• bun run format:check
• bun run test (180 pass)

Release and documentation

Patch Changeset included because the packed APM validator's published behavior now accepts canonicalized equivalent temporary roots while preserving traversal/symlink-escape rejection. No documentation changes required.

[artiphishle]

Review on head 1b6d7b8df5bde7ccfb5b56b454f85ac458969b32.

The path fix itself is correct: the extracted package/ root is canonicalized with realpath() before it becomes the containment boundary, while candidate descriptor paths are still validated through resolvePathWithinRoot and re-realpathed. The existing traversal, archive-prefix and symlink-escape protections remain intact, and the new symlinked TMP-root regression reproduces the macOS class on CI. Full suite and CI are green.

One blocker remains: this needs a patch Changeset.

Although the issue manifested as six local test failures, the PR modifies published production behavior in inspectPackedApmReleaseCandidateAsync: consumers running packed APM release validation through a symlinked/canonicalized temporary root now succeed where the published implementation rejects them. Under this repository's contract, that is release-impacting bug-fix behavior, not a fixture-only correction.

Please add one patch Changeset describing the temporary-root canonicalization fix. No other code change is required from this review.