getWorkspaceGlobMatches symlink containment and realpath errors

Trap: lexical workspace-root checks after globSync() look sufficient, but glob emits broken-symlink candidates and symlinks can physically escape the repository. Fix: validate each match as a safe path and lexically contained, then realpathSync() it and require containment under the real root plus lstatSync(...).isDirectory(). Skip only ENOENT from realpathSync() (a vanished or broken link); rethrow ELOOP, EACCES, EPERM, I/O, and programming errors so unsafe filesystem state is never masked. Keep sorted results. Regression tests must prove installed glob emits the broken link, exclude it, and prove an ELOOP link propagates.