fix: keep a root=live listing inside the session folder (release review)

The lookup judges liveWorktree.path lexically and only when the pane moves,
while the route's probe and readdir both follow symlinks. A symlink put at
that path, or at a parent of it, without moving the pane re-rooted the listing
outside workingDir. Names and sizes leaked, while file-content and file-raw
still refused the paths.

The route now resolves both folders on every request and walks the worktree
only when it lies strictly inside the resolved workingDir, otherwise it walks
workingDir. Only the check uses the resolved paths: the walk keeps the session's
spelling, so a workspace reached through a symlink still gets paths relative
to workingDir.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/session.ts

@@ -1582,7 +1582,8 @@ export class Session extends EventEmitter {
   /**
    * The linked git worktree inside `workingDir` that {@link paneCwd} is in, when there is one
    * (`live-worktree.ts`). The Files panel lists it instead of the main checkout. Runtime-only and
-   * never a confinement root, like `paneCwd`: it is always a folder the file routes already serve.
+   * never a confinement root, like `paneCwd`: it is judged lexically when the pane moves, and the
+   * listing route re-checks the real folder on every request.
    */
   get liveWorktree(): LiveWorktree | undefined {
     return this._liveWorktree;