tether-a521ba3

fix: contain new files lexically, without letting surplus ".." escape

realpath(3) fails on missing paths, so within_workspace answered
"outside" for every new file (bogus approval menu) and atomic_write's
sibling temp file then died with "cannot open temp file" (bogus failure
after approval). Resolve the nearest existing ancestor and reattach the
missing tail lexically, and create the parent directories before writing.

The lexical tail cancels name/.. pairs, but a ".." with nothing left to
cancel climbs above the existing ancestor — swallowing it read as
"inside" for ws/newdir/../../<outside>/file, and the new mkdirp then
created newdir, at which point the kernel resolved that very string
outside the workspace. Such a path now has no lexical answer and goes
through the outside-workspace confirmation. T-missing-paths' realpath
stub gains -e: bare coreutils realpath tolerates a missing last
component, realpath(3) (src/host/main.c:437) does not, and the stub
claimed to be faithful.