fix(targets): guard writers against ancestor-symlink traversal on install

[tmchow]

Summary

Follow-up to the leaf-node symlink preservation shipped in #1089 (Pi) and #1094 (Codex/OpenCode). Those guards inspect only the leaf path component (isPreservedSymlink → lstat the final node). A user who repoints a whole managed store directory — or any ancestor of it — at a personal fork slips past them, because lstat/fs.rm/copy follow every ancestor symlink. The write then operates through the link, into the fork.

This was the "ancestor-symlink traversal" class disclosed as out-of-scope in #1094's scope notes. This PR closes it for the three writers that already have the leaf-ownership contract (codex, opencode, pi).

Concrete example: user runs ln -s ~/my-fork ~/.codex/skills/compound-engineering. Before this PR, install --to codex would fs.rm and re-copy skill dirs inside ~/my-fork, clobbering their fork. After: the store is detected as escaping the codex root, skipped wholesale, and recorded as owning nothing.

Fix

A realpath-based containment check in managed-artifacts.ts:

• realpathNearestExisting(p) — realpath of the nearest existing ancestor (a not-yet-created descendant can't add a symlink hop, so this suffices and works before a fresh store exists).
• isContainedPath(rootReal, targetReal) — pure predicate; now also reused by codex's existing isPathInside, removing a duplicated relative-path check.
• isPathWithinRoot(root, target) — realpaths both sides (so a config root legitimately relocated as a whole still reads as contained) and applies isContainedPath.
• storeRootEscapesManagedRoot(root, storeDir) — warns + returns true when a store escapes; the caller then skips every operation on that store.

Applied per writer against the target root (~/.codex, the OpenCode root, the Pi store parent):

• codex.ts — guards the skills, agents, and prompts stores; escaped stores are excluded from the install manifest. The codex-local legacy-artifact mover and cleanupPreviousManagedCodexSkillStore (a recursive fs.rm) gain the same containment check at their destructive op.
• opencode.ts — guards all four stores (agents, commands, plugins, skills), each of which has a manifest ownership record.
• pi.ts — guards skills, prompts, extensions, agents; the pi-local legacy mover gains the containment check.
• managed-artifacts.ts — the shared moveLegacyArtifactToBackup gains the containment guard at its fs.rename, gated by the existing skipSymlinkGuard escape hatch (so the one intentional symlink-relocator in the cleanup command is exempt). This one line covers the OpenCode/Kiro legacy sweeps and the standalone cleanup command's move paths.

Escaped stores use the same preserved/continue idiom #1094 established, so the manifest never claims a path the install didn't write.

Verification

• 7 new tests (2 codex, 1 opencode, 1 pi, + the shared paths they exercise): a store dir that is itself a symlink into a fork, and a symlinked ancestor above the store dir (multi-level), both proving the fork content is untouched, the symlink node survives, and the manifest records nothing.
• Red-green: with src/ stashed, all 4 new ancestor tests fail — the assertion exists(fork/<written-path>) is true (the fork gets written through) without the guard, false with it.
• Full bun test: 1930 pass / 0 fail; existing fix(pi): preserve user-managed symlinks and unmanaged paths on install #1089/fix(targets): extend user-symlink preservation to codex and opencode writers #1094 leaf-preservation tests pass unmodified (leaf-symlink cases short-circuit at isPreservedSymlink before the new ancestor check). bun run release:validate in sync.

Scope decisions

• Antigravity is deliberately out of scope. It is a reachable writer but has no leaf-ownership contract at all — it overwrites real user files and leaf symlinks unconditionally. Adding only ancestor-containment there would be a misleading half-guard over a still-unconditional leaf write. Antigravity needs the fix(pi): preserve user-managed symlinks and unmanaged paths on install #1089/fix(targets): extend user-symlink preservation to codex and opencode writers #1094 leaf contract first; containment should land with it, not before. Tracked as a separate follow-up.
• Kiro inherits the shared-mover containment guard for its legacy sweep, consistent with fix(targets): extend user-symlink preservation to codex and opencode writers #1094, though it remains unreachable from the CLI.
• The managedDir manifest/legacy-backup writes (writing install-manifest.json through a symlinked managedDir) remain unguarded — lower stakes, since that path only writes CE-owned metadata, not user source. Noted here so it's tracked rather than rediscovered.
• Dangling store-root symlinks still make the initial ensureDir throw (pre-existing crash, no data loss) — unchanged from fix(pi): preserve user-managed symlinks and unmanaged paths on install #1089/fix(targets): extend user-symlink preservation to codex and opencode writers #1094.