Fix symlink escapes and file dependency edges

[zaidazmi]

Summary

• prevent symlinked files/directories that resolve outside the project root from being indexed or read
• resolve module import references to file nodes so file dependency and affected-test analysis work
• preserve unresolved refs across batched resolution so newly added files can repair relationships from unchanged files

Verification

• npm run build
• npx vitest run tests/security.test.ts tests/graph.test.ts tests/sync.test.ts
• black-box CLI check: codegraph affected src/math.ts returns tests/handler.test.ts

Notes

• npm test still fails locally on Node v24.13.0 due the pre-existing watcher flake plus V8/WASM worker crash documented in the audit; the targeted tests for this patch pass.