oj v0.2.18

Fixed

• A plugin resolveId pointing at a file reached through a symlink (a linked workspace package; on macOS any /var tmpdir path) was a 403. The serving gate checks the request's canonical path, but the allow-list entry made from the resolved path was stored raw only; those inserts now store the raw and canonical forms like every other allow-root, so the gate's ancestor check matches.