fix(undo): skip symlinks when walking snapshots

[kurtisc]

Linked Issue

Closes #1480

Summary

Skips symlinks when walking snapshots to avoid including the size erroneously in budgets.

Test Plan

Steps to reproduce

Red/green test added

Checklist

• An issue exists and is linked above
• All commits are signed-off, using DCO
• All new code follows the project's coding standards (CLAUDE.md) and is covered by tests
• Public-facing changes are paired with documentation updates
• Release note has been added to CHANGELOG.md if needed

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+374
Lines removed	-30
Total changed	404
Classification	Large (> 300 lines)

Affected crates

• crates/nono (core library) — careful review required. This is the security-critical sandbox primitive. A bug here bypasses OS-level isolation for every downstream user.
• crates/nono-cli — CLI changes. Verify argument parsing, flag documentation, and UX behaviour across supported platforms.

Blast radius — Contained

This PR touches: source code

---

_{Updated automatically on each push to this PR.}

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[nogent-nolabs-ai]

nogent code review

No critical vulnerabilities found; 2 consistency bugs identified in symlink preflight checks.

Findings (not tied to a changed line):

• 🔒 [HIGH · security] crates/nono/src/undo/snapshot.rs:256 — By completely skipping symlinks in walk_current, any new symlink created by the untrusted sandboxed agent during its execution will be omitted from current_files. Consequently, the cleanup loop in restore_to (which deletes files present in current_files but absent from the manifest) will never see or delete these symlinks, allowing untrusted symlinks to persist across session rollbacks. To fix this, walk_current should yield symlink paths with a sentinel size/hash (or a dedicated symlink variant/collection) so that restore_to can safely detect and clean them up.
• 🐛 [MEDIUM · bug] crates/nono-cli/src/rollback_preflight.rs:142 — The preflight helper detect_heavy_dirs does not check if the tracked root itself is a symlink. If a tracked root is a symlink targeting a directory, detect_heavy_dirs will traverse it using std::fs::read_dir, whereas SnapshotManager::walk_and_store and walk_current will explicitly skip it. Check the root's fs::symlink_metadata and skip it if it is a symlink, to ensure consistency between preflight detection and the actual snapshot walk.
• 🐛 [LOW · bug] crates/nono-cli/src/rollback_preflight.rs:227 — In exceeds_file_threshold, entry.path().is_file() is used to count files, which follows symlinks to their targets. This causes symlinked files inside a directory to be counted toward the preflight budget limits, despite being ignored during snapshot walking. Update the check to ensure symlinks are skipped (e.g. by checking !entry.file_type().is_symlink() && entry.path().is_file()) to match the snapshot walk logic.

_{Automated code + security review. CI already covers clippy, rustfmt, tests, cargo-audit and commit-lint.}

[SequeI]

Once the nogent security issues are addressed, we can review and likely merge!

[SequeI]

/nogent review

[SequeI]

lgtm, thank you!