feat: Restrict to workdir

[lyonsno]

Summary

This PR hardens --restrict-to-workdir path validation for apply_patch and codifies the intended safety contract with integration tests.

The key policy is:

1. Add / Update / Move to must not escape the configured workdir (including symlink traversal).
2. Delete is validated as a directory-entry operation, so deleting an in-tree symlink entry is allowed (including broken symlinks), even if the symlink target points outside workdir.

What Changed

• Added a new CLI flag wiring for restriction mode handling through server config.
• Added path-kind-aware validation for patch operations (WriteLike vs Delete).
• Enforced symlink-aware containment checks for write-like operations.
• Allowed terminal symlink deletion in delete mode while preserving containment checks on parent traversal.
• Expanded integration test coverage for restriction behavior and symlink edge cases.

Behavioral Contract Covered by Tests

• Allows in-tree patch paths under restriction.
• Blocks .. parent directory escapes.
• Blocks Add through outside-pointing symlinks.
• Blocks Update through outside-pointing symlinks.
• Blocks Move to destinations through outside-pointing symlinks.
• Allows deleting broken in-tree symlinks.
• Allows deleting non-broken in-tree symlink entries without mutating outside targets.

Testing

Ran:

• cargo test --tests

Result:

• 10 passed; 0 failed