#29457 Cloud: harden fs remove path checks

Hardens the Cloud machine fs remove route's path checks (backend/apps/api/src/cloud-machine-guest.ts):

• The route refuses a remove of the root however it is spelled (/, /., /./), not only / and ///.
• The guest program normalizes trailing . and / segments before it inspects the path, so a symlink is removed itself, and a path that resolves to / exits 47, which the route answers as 400 vm_invalid_path.

cmux-platform: the same fix landed in cmux-platform's port of these routes (manaflow-ai/cmux-platform#237); this keeps cmux-api's copy in step until the routes move.

Tests:

• test/cloud-machine-guest.test.ts (workerd): the new root spellings are refused before any guest call, and exit 47 answers 400.
• test-node/cloud-machine-guest-program.test.ts (new, Node): runs the real program with the local python3 on a temporary tree, with shutil.rmtree and os.unlink replaced by prints, so no run can delete anything. It runs through a new vitest.node.config.ts (bun run test:node) and a new step in backend.yml after the Worker tests; the Worker config now includes only test/.

Risk: low. Only removes that resolve to the root, or that name a symlink with a trailing / or /., change behavior.

Agent session: agent session

🤖 Generated with Claude Code