[Bug] Kit files[] symlinked source copies as a dangling link on msb; ../ sources undocumented #517

What happened?

A kit files[] entry whose source: is a symlink passes acq kit validate but fails on apply with the msb backend: msb copy copies the symlink itself, so the guest file is a dangling link.

acq(msb): warning: gsa-agentic-coding:/home/agent/.agents/skills/issue-triage/SKILL.md not observable after copy (18 checks); retrying copy once.
acq(msb): error: could not place kit file at gsa-agentic-coding:/home/agent/.agents/skills/issue-triage/SKILL.md

In the guest:

lrwxrwxrwx 1 root root 65 ... SKILL.md -> ../../../../../../../../home/.agents/skills/issue-triage/SKILL.md

kit validate checks [ -f "${kitdir}/${src}" ] (acq.backends/kit-translate.sh), which follows symlinks, while _acq_msb_copy_file_verified (acq.backends/msb.sh) passes the path to msb copy unresolved.

Meanwhile a source: with ../ (e.g. ../../../home/.agents/skills/issue-triage/SKILL.md) passes validation and the kit_spec_files filter and copies correctly on msb, although the validate comment says each source "must exist under the kit dir".

What did you expect?

Validation and apply to agree. Either:

• dereference a symlinked source before copying (e.g. realpath), or
• reject symlinked sources in kit validate,

and document whether sources outside the kit dir (../) are supported, so kits can rely on it or avoid it. Use case: a mixin kit shipping skill files maintained elsewhere in the same repository without duplicating them.

Steps to reproduce

1. In a kit dir, create files/home/example.md as a relative symlink to a regular file outside the kit, and add a files[] entry with path: /home/agent/example.md and source: files/home/example.md.
2. acq kit validate <kit-dir> → OK.
3. acq kit apply <msb-sandbox> <kit-dir> → "could not place kit file"; the guest file is a dangling symlink.
4. Change source: to a ../ path to the same file → validate and apply both succeed.

Docker version

Docker version 29.8.1, build 4a63305d74 (not involved: msb backend)

Operating System

macOS 26.7

SBX method

Not sure (neither: acq with the msb 0.7.3 backend)

Additional context

acq at 187aa57, msb 0.7.3. Not checked on the sbx backend.