Symlink traps in recursive collection and worktree dependencies

Recursive file collection must use lstat, skip symlinked directories, and track visited realpaths; ancestor-pointing directory symlinks otherwise recurse forever, especially in macOS framework and dSYM trees. File symlinks may still be followed. Separately, a worktree node_modules symlink is safe only when both worktrees share the same branch and lockfile. Otherwise esbuild can fail with Host version X does not match binary version Y; remove the symlink and run pnpm install in the affected worktree.