fix: harden linux deny mount canonicalization

[jy-tan]

Summary

Follow up on #53 by hardening Linux deny mount setup at mount-application time. This ensures deny mount destinations are canonicalized before bwrap arguments are emitted, reducing startup failures on symlink/alias-heavy systems (see #51), while preserving existing deny precedence behavior.

Changes

• Canonicalize deny mount destinations in Linux mount planning (resolvePathForMount), including symlinked ancestor paths
• Apply canonical mount resolution to runtime exec-deny masking (not just executable path resolution)
• Skip unmountable runtime deny targets with debug logging to avoid hard bwrap startup failures
• Preserve explicit denyRead precedence and existing dangerous-path protections
• Expand test coverage:
  • Linux unit tests for mount-path canonicalization and runtime deny mount behavior
  • Runtime exec-deny unit tests for canonical alias dedupe and default chroot deny path coverage
  • Linux integration tests for symlinked global gitconfig and /bin alias runtime deny scenarios

[cubic-dev-ai]

No issues found across 5 files