[WSLC] Alias cannonicalization follow-up in denied-path overlap validator

[SohamDas2021]

📖 Description

Follow-up to #657 , addressing the following:

1. Tier-2 canonical-equality miss ( policy_mapping.rs ): the overlap validator now rejects a deny that canonicalizes exactly onto a mount root via an on-disk alias (which  contains_strictly  missed and D6 saw as absent), but only when the original strings differ lexically — so a literal exact match stays enforceable-by-not-mounting.
2. Dangling reparse point misclassified as  Absent  ( filesystem_canonical.rs ): a dangling junction/symlink returned FILE/PATH_NOT_FOUND and was labelled  Absent ; it now re-probes with  FILE_FLAG_OPEN_REPARSE_POINT  and returns  Unknown  (fail closed) when the link object itself exists.
3. Hard-link doc correction ( policy_mapping.rs ): fixed the comment to state hard links are names for one object and D6 groups hard-linked policy entries by file ID — the only residual gap is an unlisted hard link inside a mounted subtree.

🔗 References

🔍 Validation

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See docs/pull-requests.md.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See docs/pull-requests.md
for the steps.

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Strengthens WSLC denied-path alias validation and dangling reparse-point handling.

Changes:

• Detects canonical equality between denied paths and mount roots.
• Re-probes dangling reparse points.
• Corrects hard-link documentation and adds regression tests.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/core/wxc_common/src/filesystem_canonical.rs	Handles dangling reparse points during canonicalization.
src/backends/wslc/common/src/policy_mapping.rs	Extends overlap validation and updates alias documentation.