Refuse templates read through a symlink anywhere under files/

A symlinked files/ or a symlinked directory under it let module check, the merge
gate and module add read a template from outside the repository tree, and a
symlink no template names passed them while the build's packing refuses it
(review of mesh-controller#313). Every entry under files/ must now be a plain
directory or file, and templates are read through an os.Root of the module's
directory.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/mesh-controller/template_test.go

@@ -62,6 +62,18 @@ func TestModuleCheckReadsTemplatesFromTheTreeBesideTheManifest(t *testing.T) {
 		t.Fatalf("a template whose text is refused inline passed:\n%s", out.String())
 	}
 
+	// A symlink under files/ that no template names: the build's packing refuses it, so the check does too.
+	linked := t.TempDir()
+	aTemplatedModule(t, linked, templatedNotifier, map[string]string{"files/notifier.conf": "volume = 3\n"})
+	if err := os.Symlink("/etc/hostname", filepath.Join(linked, "files", "elsewhere")); err != nil {
+		t.Fatal(err)
+	}
+	out.Reset()
+	if err := moduleCheck([]string{filepath.Join(linked, "module.json")}, &out); err == nil ||
+		!strings.Contains(out.String(), "files/elsewhere is a symlink") {
+		t.Fatalf("a symlink under files/ passed the check:\n%s", out.String())
+	}
+
 	// And a template the tree lacks, by name.
 	missing := aTemplatedModule(t, t.TempDir(), templatedNotifier, nil)
 	out.Reset()
@@ -139,6 +151,21 @@ func TestTheMergeGateJudgesAChangeToATemplateAlone(t *testing.T) {
 		t.Fatalf("a template the controller refuses passed the gate:\n%s", v.Report())
 	}
 
+	// A symlinked files/ fails: nothing is read from outside the tree.
+	tree := aTree(t, withEdit(manifests, "notifier", ""))
+	elsewhere := t.TempDir()
+	if err := os.WriteFile(filepath.Join(elsewhere, "notifier.conf"), []byte("volume = 3\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	aTemplatedModule(t, filepath.Join(tree, "modules", "notifier"), templatedNotifier, nil)
+	if err := os.Symlink(elsewhere, filepath.Join(tree, "modules", "notifier", "files")); err != nil {
+		t.Fatal(err)
+	}
+	v = gateJudged(t, f, tree, notifierTemplate)
+	if v.Verdict != "fail" || !strings.Contains(v.Report(), "files/ is a symlink") {
+		t.Fatalf("a symlinked files/ passed the gate:\n%s", v.Report())
+	}
+
 	// And the template removed from the tree fails, naming it.
 	v = gateJudged(t, f, aTemplatedTree(t, manifests, "", false), notifierTemplate)
 	if v.Verdict != "fail" || !strings.Contains(v.Report(), "files/notifier.conf") {