[ENHANCEMENT] Extract shared path-confinement utilities for safe symlink-following filesystem access

[edelauna]

Problem (one or two sentences)

Path-confinement logic that validates symlink-resolved paths stay within an allowed directory is duplicated across services, and at least one symlink-following code path (src/services/command/commands.ts) relies on depth-limiting alone with no confinement check, creating a potential arbitrary file read risk.

Context (who is affected and when)

Affects contributors adding new filesystem features and users relying on the extension to safely handle symlinks in rules and command directories. The gap is most relevant when a workspace contains crafted symlinks pointing outside the allowed directory.

Desired behavior (conceptual, not technical)

A single, well-tested set of path-confinement helpers should exist in src/utils/ so that any symlink-following code can easily enforce that resolved paths stay within their intended root directory, without each service reimplementing the check.

Constraints / preferences (optional)

• No behavior change for valid in-tree symlinks.
• Follow the real-filesystem test pattern already used in src/utils/__tests__/WorkspacePathResolver.spec.ts (no fs mocking).
• Pure internal refactor — no user-visible change.

Acceptance criteria (optional)

• Move isRealPathInsideDirectory, assertRealPathInsideDirectory, and isPathInsideDirectory from src/services/rules/rules.ts (~lines 374–390) to src/utils/path.ts (or src/utils/fs.ts).
• Unit-test both the lexical (isPathInsideDirectory) and fs.realpath-based (isRealPathInsideDirectory) variants in isolation.
• Update src/services/rules/rules.ts to import from the new location (no behavior change).
• Audit src/services/command/commands.ts (resolveCommandSymLink, tryResolveSymlinkedCommand): add a confinement check if warranted, or explicitly document why it is intentionally unbounded.
• External symlink targets must continue to be rejected in rules; commands must be audited and treated consistently.

Proposed approach (optional)

This is a follow-up to PR #657, which added the confinement helpers for the Rules service. The extraction is a pure refactor — move the three helpers, add unit tests, update the import in rules, and audit commands.

Trade-offs / risks (optional)

Low risk — moving pure functions with no side effects. The main consideration is ensuring the fs.realpath call behaviour is consistent across platforms (see existing notes in WorkspacePathResolver.ts about macOS case-insensitivity).