Cover dangling config-input symlinks and preserve named diagnostics #397

Source finding

During cross-family review of #396, canonicalization of a dangling symlink was found to call realpathSync on the link. For a contained link whose target is missing, this throws ENOENT instead of the earlier allowMissing binding. The symlink regression covers existing outside targets and missing descendants, but omits this case.

Follow-up

Add a synthetic contained dangling-link case and an outside dangling-link control. Trace the failure through the normal writer/checker entry points. Preserve safe refusal of unresolved or outside targets, and ensure any user-visible failure has a named code, the input identity and an actionable remedy. Preserve compatibility rules for prior records and refused-write byte identity.

This is a non-blocking diagnostic follow-up to #336. The current fix addresses missing inputs under symlinked project roots and preserves project-escape refusals.