fix(codex): close symlink escape on GET /file, pin project writes to server cwd

server/lib/codex-mutate.js

@@ -300,6 +300,7 @@ module.exports = {
   deleteArtifact,
   listBackups,
   resolveTarget, // exported for tests
+  assertNotSymlinkEscape, // shared with codex-discovery.js's readFileSafe — one check, both verbs
   TYPES,
   NAME_RE,
 };