fix(build): refuse a symlink as an archive member

[rmyndharis]

Collecting archive members used statSync, which follows symlinks. A directory link inside a plugin therefore pulled whatever it pointed at into the zip: a ui link to a sibling directory put that directory's files into the archive, contents and all, and the build reported success.

The entry string itself is perfectly ordinary in that case — ui/index.html names a relative path inside the plugin — so validating the entry could never have caught it. The escape happens on the filesystem, not in the manifest.

Members are now collected with lstatSync, and a link is refused wherever it appears: as the entry itself, or nested inside a directory being packaged. The message names the offending path.

Refusing rather than resolving is both simpler and more correct here. The archive stores file contents, so a link would be flattened into a copy regardless of where it pointed, and an absolute link names a path that exists only on the machine that built the package.

Collection also moved next to the entry validation it belongs with, so both halves of "what goes into the package" are covered by the same tests rather than one being untestable inside the packaging script.

Verification

• Reproduced first: a ui link to a sibling directory produced a 5-member archive whose contents included a file from outside the plugin entirely. After the change both that case and a link nested one level deeper are refused, with no zip left on disk.
• 569 tests pass, typecheck clean, catalog up to date, all 10 plugins build and load.
• Artifacts are unchanged: chat-flow, after-hours and gsheets-logger rebuild byte-identical to main.