ATUI-9: Deny-list, absolute paths, tilde, symlink canonicalization

[guimorg]

What to build

Broaden the path scope of @file references beyond CWD, and add the security boundary that keeps the broader scope safe.

Behavior:

• Accept absolute paths (@/abs/path) and ~ expansion (@~/notes/foo.md).
• Canonicalize the resolved path (follow symlinks) before any further check.
• Enforce a compiled-in deny-list against the canonical path.
• Deny-list check runs before the size cap, so a huge deny-listed file errors as sensitive-path rather than too-large. Prevents a size-based oracle.

Deny-list patterns (compiled into the binary, changing them is a code change with a test):

• ~/.adapt/config.toml
• ~/.ssh/*
• **/.env*
• **/id_rsa*
• **/*.pem
• **/.aws/credentials
• **/.gnupg/*

Acceptance criteria

• @/abs/path/to/file.md resolves correctly
• @~/notes/foo.md expands ~ to the user's home directory
• Resolved paths are canonicalized (symlinks followed) before further checks
• Deny-list is compiled into the binary; adding or changing a pattern requires a code edit and a test
• A symlink under CWD pointing at ~/.ssh/id_rsa is refused with the deny-list error, not the CWD-escape error
• Each deny-list pattern has a test that creates a matching file under a tempdir and asserts refusal
• Deny-list check runs before size check; verified by a test with a >1MB sensitive-path file that errors as sensitive-path
• Error messages name the file and the rule that refused it, e.g. refused @path: matches sensitive-path deny-list

Blocked by

• ATUI-8: CWD-relative @path inlines file contents #13 (ATUI-8: CWD-relative @path inlines file contents)