fix(security): harden artifact source identity

[Eclipseic1848]

Summary

• reject leaf symlinks and linked/nested temporary output paths before Artifact import
• pin reads to an opened FileHandle and verify file identity before reading/deleting
• preserve valid output capture, redaction, hashing, and source cleanup
• synchronize the bundled Python Worker

Verification

• red test reproduced the junction escape on Windows
• npm workspace Artifact tests: 9 passed, 1 platform skip
• CoreMind Tools project: 71 passed, 3 skipped
• Python Node parity: 6 passed
• all workspace typechecks passed
• Biome lint passed

Closes #160