fix: Harden filesystem contains checks

[T1mn]

What does this PR do?

• Tightens Filesystem.contains by resolving real paths so symlinks and .. can’t escape the project root.
• Adds path traversal tests, including a symlink escape case (skipped on Windows where symlinks may be restricted).

How did you verify your code works?

• Ran cd packages/opencode && bun test file/path-traversal.test.ts (all tests passed).

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

Potential Duplicate Found:

• fix: prevent symlink escape in Filesystem.contains #6403: "fix: prevent symlink escape in Filesystem.contains"
  • fix: prevent symlink escape in Filesystem.contains #6403

Why it's related: This PR appears to address the exact same issue as the current PR (#7449). Both are focused on hardening the Filesystem.contains() method to prevent symlink escape attacks and path traversal vulnerabilities. The descriptions are nearly identical in scope.

Recommendation: Check if #6403 is still open/active or if #7449 is intended to supersede it. They should be consolidated to avoid duplicate work.