fix: reject external symlink targets during hydrate

[Aphroq]

Summary

This pull request rejects tar symlink targets that point outside the extracted archive root during workspace hydrate and restore flows.

• add strict symlink-target validation to tar_utils for hydrate paths while keeping the general tar helpers' default behavior unchanged
• enable the stricter validation in UnixLocal, Docker, and tar-based extension backends before they materialize a workspace archive
• add regression coverage for strict tar validation plus UnixLocal and Vercel hydrate paths

Compatibility change: If a user’s sandbox snapshot/workspace contains symlinks intentionally pointing to system paths (e.g., /usr/bin/python, certain toolchain paths, or host mount points), then after hydrate/restore these will change from “restorable” to “refused to restore.”

Test plan

• uv run pytest tests/sandbox/test_tar_utils.py tests/sandbox/test_extract.py tests/extensions/sandbox/test_vercel.py
• bash .agents/skills/code-change-verification/scripts/run.sh

Issue number

Closes #3093

Checks

• I've added new tests (if relevant)
• I've added/updated the relevant documentation
• I've run make lint and make format
• I've made sure tests pass