#7897 fix(workspace-fs): allow viewing symlinks outside workspace root

What & why

Opening a workspace symlink whose target is outside the workspace currently fails with “Path resolves outside workspace root.” Allow the shared filesystem read operation to follow these links, matching its existing support for directly opening external files. This covers symlinked files and files under symlinked directories. Write restrictions remain in place.

How I tested it

• Filesystem unit tests: 42 passed, including reading an external file through a workspace symlink.
• Host-service integration tests: 35 passed across bug-hunt.integration.test.ts and bug-hunt-2.integration.test.ts, covering external file/directory symlink reads and rejecting writes through them.
• CI identified one additional old rejection expectation in bug-hunt.integration.test.ts; updated it to the intended read behavior and verified all 17 tests in that file pass.
• bun run lint: passed.
• bun run typecheck: passed (42 tasks).
• bun run check:plugins: passed.
• Full bun run test: failed in the desktop suite (7,651 passed, 34 failed), including git/worktree and shell-environment tests. The full run is not green; the failures have not been isolated against the base branch.
• Desktop UI was not manually verified.

Checklist

• PR title follows conventional commits (type(scope): subject)
• bun run lint and bun run typecheck pass (CI fails on lint warnings too)
• "Allow edits from maintainers" is checked on fork PRs (not applicable; same-repository branch)