fix(mcp): close the symlink escape in the write guard + more #171 validation

[c2j]

Follow-up hardening + extra validation on the #171 work (which is already merged and closed).

1. Real gap found and fixed: symlink escape in the write guard

confine_to_root only normalized paths lexically. A .codeweb symlink inside the project pointing elsewhere looked like an in-root path, so the store write landed outside the permitted directory.

Verified as Red before fixing: confine_rejects_symlinked_subdir_escaping_root failed on the old guard (lexical check passed).

Fix: after the lexical check, canonicalize the deepest existing ancestor of the target and compare it with the canonicalized root. Both sides are canonicalized, so a path that merely traverses a symlink (e.g. /tmp → /private/tmp on macOS) is still accepted — covered by confine_accepts_real_dirs_and_symlinked_root.

Integration proof: test_mcp_analyze_rejects_symlinked_store_dir builds a project whose .codeweb is a symlink to an outside dir, calls codeweb_analyze, and asserts status:"error" and that the symlink target stayed empty.

2. Extra validation of the finished work (behaviors that already worked, now locked down)

Check	Test
Corrupt store is reported explicitly, then codeweb_analyze self-heals it	test_mcp_analyze_heals_corrupt_store
Pipelined analyze+analyze+stats all answer, no lock deadlock, consistent state	test_mcp_handles_pipelined_requests
--project pointing at a not-yet-existing directory works with codeweb_init	test_mcp_init_creates_missing_project_directory
init_at: empty dir list defaults to ["."]; absolute source dirs preserved verbatim	init_at_defaults_to_root_when_no_source_dirs_given, init_at_keeps_absolute_source_dirs_absolute

The last two init_at tests are characterization tests for previously untested branches (they pass on the existing implementation); they are not Red→Green cycles.

3. Docs

Plan doc and DeveloperGuide updated to describe the two-layer guard and the new loops.

Verification

• cargo fmt --all -- --check clean
• cargo clippy --features full -- -D warnings clean
• cargo test --features full -- --skip test_path_mapping_applied --skip test_serve_ → 40/40 suites ok, 0 failures (mcp_test 17 passed)
• End-to-end acceptance re-run against the rebuilt binary: 40/40 assertions pass