fix(filesystem): validate canonical allowed paths

[he-yufeng]

Summary

• fix filesystem path validation when the requested path canonicalizes into an allowed directory
• cover both existing paths and new files whose parent resolves to the allowed canonical path
• preserve the symlink escape check for paths whose real target is still outside the allow-list

Fixes #4129.

Validation

• npm exec -w src/filesystem -- vitest run __tests__/lib.test.ts --reporter=dot -> 48 passed
• npm run build -w src/filesystem -> passed
• npm test -w src/filesystem -- --reporter=dot -> 149 passed
• git diff --check -> passed
• secret scan on touched files -> no matches

prettier --check still reports these two filesystem files as unformatted on upstream origin/main, so I did not reformat the whole files for this focused fix.