fix(cli): preserve symlinks during sandbox upload

[johntmyers]

Summary

Preserve symlink entries when building sandbox upload tar archives instead of dereferencing them into their targets. This also routes single symlink uploads around git-filter canonicalization and uses symlink-aware existence checks so dangling symlinks are handled consistently.

Related Issue

Fixes #1425

Supersedes #1561

Changes

• Replaced recursive upload archive building with symlink_metadata-based traversal that emits symlink tar entries.
• Bypass git_sync_files for single symlink uploads so tracked, untracked, and dangling symlinks reach the archive writer.
• Use symlink-aware local path checks for sandbox upload, create-time --upload, and legacy sync upload paths.
• Added regression tests for directory symlinks, file-list symlinks, single symlinks, and dangling symlinks.

Testing

• cargo test -p openshell-cli symlink
• cargo test -p openshell-cli
• cargo fmt --all -- --check
• git diff --check
• mise run pre-commit
• Docker gateway smoke test against docker-dev on 0.0.51-dev.5+gac6a0a02

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-1595.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied for a79b083. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.