feat: add selective Workdir symlink policies

crates/tools/src/bash.rs

@@ -300,11 +300,13 @@ mod tests {
                     target: root.path().to_path_buf(),
                     permission: Permission::Write,
                     recursive: true,
+                    symlink_policy: Default::default(),
                 },
                 ScopeRule {
                     target: output.path().to_path_buf(),
                     permission: Permission::Read,
                     recursive: true,
+                    symlink_policy: Default::default(),
                 },
             ],
             deny: Vec::new(),

crates/tools/tests/edge_cases.rs

@@ -40,6 +40,7 @@ fn setup() -> (TempDir, TempDir, Registry) {
         target: spill.path().to_path_buf(),
         permission: Permission::Read,
         recursive: true,
+        symlink_policy: Default::default(),
     });
     let scope = Scope::from_config(&config).unwrap();
     let fs: WorkdirSessionHandle =

crates/tools/tests/integration.rs

@@ -27,6 +27,7 @@ fn scope_with_spill(workspace: &Path, spill: &Path) -> Scope {
         target: spill.to_path_buf(),
         permission: Permission::Read,
         recursive: true,
+        symlink_policy: Default::default(),
     });
     Scope::from_config(&config).unwrap()
 }