fix: allow in-scope symlinked skill destinations

[forhappy]

Summary

• Allow skill destinations to traverse symlinked parent directories when the fully resolved target remains inside the selected scope.
• Continue rejecting symlink escapes outside the project or configured scope.
• Add CLI regression coverage for the reported .claude/skills -> ../.agents/skills layout and out-of-scope links.

Root cause

validate_skill_destination rejected every symbolic-link ancestor before checking where it resolved. This blocked legitimate project-local skill layouts such as the reported Claude link.

Validation

• cargo fmt --all -- --check
• cargo clippy --workspace --lib --bins --locked -- -D warnings
• cargo test -p compass-cli --test install_cli --locked (26 passed)
• cargo test -p compass-cli --test compass_product --locked (8 passed)
• cargo test --workspace --lib --bins --locked
• sh scripts/check_product_boundary.sh