Path deny-lists for agents must resolve symlinks

An agent was told never to read one directory tree on a shared host. A shared 'interface' folder that agents were allowed to use contained a symlink into exactly that tree, so the agent used code from it for an hour without noticing, until a traceback showed the resolved path. A deny-list written as a path prefix doesn't stop this. Have agents run readlink -f (or realpath) on every input path before use and check the resolved path against the deny-list. Audit shared folders with find <dir> -type l -exec readlink -f {} +. Ask the owner of the shared folder to publish real copies (with a checksum manifest) instead of links. When a breach is found: stop, don't delete, revert with commits on top, set the derived files aside in a labelled quarantine folder, and keep the measured results but label them pending a clean rebuild.