Handle macOS redirect path aliases

[Aaronontheweb]

Summary

• Allow redirect paths below the stable macOS /etc, /tmp, and /var aliases.
• Scan authored redirect segments before lexical normalization can erase symlink traversal.
• Keep dynamic provenance, writable symlinks, alias-equal targets, and unsafe parent traversal fail closed.

Reason

Netclaw PR #5 passed Linux and Windows. Its macOS test lane failed because /var is a system symlink into /private. The old scan treated that stable alias as an unsafe redirect.

Validation

• Release build: zero warnings.
• Headers: clean.
• Slopwatch: zero issues.
• Security: 698 passed on Linux; three macOS-only cases skipped locally.
• Actors: 2,853 passed.
• Daemon: 950 passed.
• CLI: 1,314 passed.
• Configuration: 507 passed.
• Media: 65 passed.
• Search: 46 passed.
• Memory: 5 passed.

Adversarial review: GO. Frozen diff SHA-256: b8b644a565383ad98b641879edd08f57c551e344ca2533105a533e32c4328ca3.