Resolve symlinks before the shell secret denylist

[TheGreatAxios]

Summary

• Shell secret matching resolves symlinks before the denylist, so a benign-named symlink into a secret file asks exactly like the secret name itself
• One shared token matcher serves both call sites, with the cheap lexical check first and realpath only for path-like survivors, so the hot auto-allow path stays syscall-free
• Pure name-listings still list freely: dumping contents asks, listing a name does not
• Connection-string keys stay out of the env-key scrub classifier; widening that shape check would redact benign connection strings and needs its own measured ticket

Verification

• bun run lint, bun run typecheck, bun run build pass
• New regression suite covers the symlinked dump, the direct secret name, unaffected listings, both call sites, and the shared helper
• Full suite: 7081/7082 pass; the single failure (gaasbot prompt size budget) also fails on origin/main with changes stashed, so it predates this branch

Fixes CL-7790

[linear-code]

CL-7790