ci-secure (LOW): a symlinked workflow path could disclose a file outside .github/workflows

The scanner enumerates .github/workflows/*.yml and reads each file. If an entry in that directory is a symlink pointing outside the workflows directory (or outside the repo), the scanner would follow it and could surface that target's path/contents in evidence or coverage output. Impact is LOW — it requires an attacker-authored symlink already committed to the repo under audit, and the audit is run by the repo's own operator — but a scanner should not follow a workflow-path symlink out of its intended scope.

Ask: when reading a workflow file, resolve the real path and skip (with a coverage note) any entry whose target escapes .github/workflows/, rather than reading through the symlink.

Found during the ci-secure launch-readiness review (panel P3).