fix: validate canonical output paths after extension enforcement

[huynhtrungcsc]

Fixes output path validation so tools cannot validate one path and then write to a different canonical target after extension enforcement.

Changes:

• Resolve dangling symlinks to their target path during canonicalization.
• Validate the final extension-enforced output path before writing.
• Apply the same final-path validation to heap snapshots and screencasts.
• Add regression coverage for dangling symlinks that point outside configured roots.

Validation:

• npm run format
• npm run check-format
• npm run test tests/utils/files.test.ts
• npm run test tests/roots.test.ts
• npm run test tests/tools/memory.test.ts tests/tools/screencast.test.ts

Note: I also ran the full npm test suite locally. The targeted tests above passed, but the full suite hit local WSL daemon/e2e startup timeouts while waiting for daemon.pid / server_start, which appear unrelated to this path-validation change.