fix(compile): decide how the package-config check treats symlinked config files #2360

Follow-up from the #2315 review (Rust reviewer, unposted theme).

package_config_check resolves the well-known config files at the repository root with std::fs::metadata, which follows symlinks. A symlinked nuget.config or .npmrc is therefore scanned at its target, which can be outside the repository.

Following the link matches what the package manager does at runtime, which is arguably the right behaviour for a check meant to predict runtime failures. But it means compile reads files outside the repo and can quote URLs from them in warnings.

Acceptance criteria

• Choose and document one of:
  • (a) keep following symlinks, documented, with a test;
  • (b) follow only links that resolve inside the repository;
  • (c) skip symlinked config files with an advisory note.
• Add a test for the chosen behaviour.