fix(template): reject symbolic links

[rissrice2105-agent]

Summary

• identify symbolic links and special entries while planning a template install
• reject the whole template before writing any destination file
• preflight every planned source as a regular file before copying
• add a synthetic-data regression for the symlink path

Security impact

Remote templates are advertised as inert files, but the previous copy path followed symbolic links. A template could therefore copy a readable local file into the generated project. This change rejects links instead of dereferencing them.

Tests

• node --test test/templates.test.mjs - 15 passed, 1 skipped on Windows because creating symlinks requires elevated privileges
• full node --test - 622 passed, 194 skipped, 18 existing Windows/shell failures unrelated to templates
• git diff --check

Closes #204