* fix: reject case-variant symlinked file paths * fix: validate requested case-variant symlink paths
Hardens the macOS bar launch.json descriptor against untrusted/foreign-owned files and constrains the decoded descriptor; blocks dashboard file writes to the launch descriptor.