fix(filesystem): handle UNC share root allowlists

[he-yufeng]

Fixes #3756.

UNC share roots keep a trailing separator after Windows path normalization. The allow-list check then appended another separator before the prefix comparison, so a file under \\server\share\ was compared against \\server\share\\ and rejected.

This keeps the existing equality check and only adds a separator when the normalized allowed directory does not already end with one.

To verify

• npm exec -w src/filesystem -- vitest run tests/path-validation.test.ts --testNamePattern "UNC paths"
• npm exec -w src/filesystem -- vitest run tests/path-validation.test.ts
• npm run build -w src/filesystem
• git diff --check

[he-yufeng]

Closing this older branch in favor of #4265, which keeps the UNC share-root fix and also covers the mapped-drive-to-UNC allow-list case from #4129. Keeping one PR should make review easier.