refactor(fspy): return resolved paths without callbacks

[wan9chi]

Motivation

to_absolute_path still exposes each resolved path through a callback even though every intercepted call can provide a signal-safe arena. Accept that allocator directly and return the resolved path instead.

The return type is sigsafe::CStr<Fat> rather than a plain BStr, because execveat forwards the result to a real exec, which needs a terminator. Carrying that in the type means an implementation cannot hand the exec unterminated bytes; callers wanting the path without the NUL use as_bytes.

Descriptor resolution continues to produce a vector, so relative pathnames and the trailing NUL are appended to that same storage before it is left in the arena. Already-absolute inputs return their original C string with no allocation at all. execveat resolves once and makes one handle_exec call.

[github-actions]

fspy benchmark

linux

dynamic/launch             change  +0.52%  [ -4.11% ..  +5.23%]  overhead   +53.96%
dynamic/access             change  +0.77%  [-10.47% ..  +3.18%]  overhead    +8.19%
dynamic/access-relative    change  -0.20%  [ -1.26% ..  +0.88%]  overhead   +47.17%
static/launch              change  +0.87%  [ -5.86% ..  +8.23%]  overhead  +152.71%
static/access              change  +0.44%  [ -1.38% ..  +1.57%]  overhead  +833.04%
static/access-relative     change  +0.08%  [ -1.39% ..  +1.61%]  overhead +1340.79%

macos

dynamic/launch             change  -0.08%  [ -1.73% ..  +1.82%]  overhead  +214.04%
dynamic/access             change  +0.00%  [ -1.54% ..  +1.96%]  overhead    +2.76%
dynamic/access-relative    change  +0.89%  [ -1.19% ..  +2.63%]  overhead  +262.37%

windows

dynamic/launch             change  -0.08%  [ -2.21% ..  +2.46%]  overhead   +28.19%
dynamic/access             change  +0.00%  [ -0.20% ..  +0.79%]  overhead    +1.40%
dynamic/access-relative    change  +0.19%  [ -0.39% ..  +0.58%]  overhead    +1.35%