path-containment 1

Pre-dispatch guard for dsh writes whose path leaves the granted write area through a link. Every write confinement in the harness canonicalizes first and then refuses, which is the right enforcement answer and a poor diagnostic one: `<workspace>/link/out.