fix(tools): ToolExecutor forwarding gaps, symlinked checkpoint drop, checkpoint tests

[bug-ops]

Summary

• CompressedExecutor, ToolFilter, and Arc<ShellExecutor> now forward every cross-cutting ToolExecutor method to their inner/wrapped executor instead of silently falling through to trait defaults — same defect class as checkpoint_undo/redo/list not forwarded by TrustGateExecutor/PolicyGateExecutor/AdversarialPolicyGateExecutor, breaking /undo in standard production wiring #5899/checkpoint_undo/redo/list not forwarded by ScopedToolExecutor/ShadowProbeExecutor — breaks /undo even after #5899, since these sit outside the gated chain #5905/ScopedToolExecutor does not forward requires_confirmation, defaulting to false for the outermost wrapper #5906 (fixed by fix(tools): forward checkpoint and confirmation methods through executor wrappers #5930) and CompositeExecutor does not forward requires_confirmation; AdversarialPolicyGateExecutor does not forward is_tool_speculatable #5900/CompositeExecutor does not override execute_tool_call_confirmed, silently re-running the full confirmation check on the composed tree #5938/PolicyGateExecutor/AdversarialPolicyGateExecutor do not forward requires_confirmation #5931 (fixed by fix(tools): forward requires_confirmation/is_tool_speculatable/execute_tool_call_confirmed through remaining ToolExecutor wrappers #6011). The execute_confirmed forward on Arc<ShellExecutor> closes a currently-dormant gap (its only caller today is #[cfg(test)]-gated; production dispatch goes through execute_tool_call_confirmed) but is worth fixing as defense-in-depth.
• capture_snapshot_for no longer silently drops a checkpoint for a newly-created file under a symlinked allowed_paths prefix on macOS (e.g. /tmp -> /private/tmp). A new shared canonicalize_or_nearest_ancestor helper resolves symlinks via the nearest existing ancestor when the target path itself doesn't exist yet, and also deduplicates the equivalent logic previously inlined in validate_sandbox_with_cwd.
• Added regression coverage for the ShellExecutor checkpoint stack: redo without a prior undo (no-op), checkpoint_list ordering with multiple entries, and a multi-step undo/redo/undo depth sequence.

Closes #6012
Closes #6001
Closes #5999

Test plan

• cargo +nightly fmt --check
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings
• cargo nextest run --config-file .github/nextest.toml --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins — 12722 passed, 0 failed, 35 skipped
• RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace --features "desktop,ide,server,chat,pdf,scheduler"
• Regression test for capture_snapshot_for silently drops checkpoints for newly-created files under symlinked allowed_paths on macOS #5999 exercises a raw (non-canonicalized) symlinked /tmp prefix and was verified to fail without the fix
• New cross-cutting forwarding tests use distinguishable stub values to genuinely discriminate correct vs. incorrect forwarding