[infra-lead-agent] fix(provisioner): skip symlinks in template WalkDir (OFFSEC-010)

filepath.WalkDir follows symlinks, which could bypass the path traversal
guard in addFile() if a symlink inside the template directory points
outside it (e.g. a symlink to ../../../etc/passwd).

Fix: add an explicit symlink check after the walkErr guard that returns
nil (skip) when d.Type()&os.ModeSymlink != 0.

The existing IsRegular() check catches non-regular non-symlink files
(devices, sockets) but symlinks are regular files (they point to
something), so they need explicit skipping.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

workspace-server/internal/provisioner/cp_provisioner.go

@@ -269,6 +269,11 @@ func collectCPConfigFiles(cfg WorkspaceConfig) (map[string]string, error) {
 			if walkErr != nil {
 				return walkErr
 			}
+			// Skip symlinks to prevent path traversal via ../  relative paths
+			// inside the template directory (OFFSEC-010).
+			if d.Type()&os.ModeSymlink != 0 {
+				return nil
+			}
 			if d.IsDir() {
 				return nil
 			}