fix: handle symlinked ancestors in bwrap writable roots

Co-authored-by: Codex noreply@openai.com