## resolveAndValidatePath performs lexical containment only — symlinks can escape the build context

**Component:** operator-foundry

The path-containment check used to confine build-context file access performs only lexical (string-based) validation of the resolved absolute path. It does not resolve symlinks before the containment check, so a symlink inside the build context can point outside of it and escape the intended confinement.

### Remediation
After computing `candidateAbs`, call `filepath.EvalSymlinks(candidateAbs)` (and `filepath.EvalSymlinks(ctxAbs)`) and re-run the `filepath.Rel`/`..` check on the resolved real paths; alternatively use `os.Root` (Go 1.24+) / `securejoin` to open the build context as a confinement root.

---
*Source: Ex-Wing/Glasswing Konflux CI security assessment (Mythos), finding FIND-003*