msb: create fails when the provenance dir is reached through a symlink (verify-backends broken on macOS) #594

Bug

On msb, acq create fails when ACQ_PROVENANCE_DIR (or the default provenance dir) sits under a symlinked path. msb rejects the read-only host-config mount that #504 added:

error: invalid config: bind mount host path /var/folders/.../T//acq-verify-state.L98y0J/provenance/msb/shell-ws-umorpy.3363652959.config goes through symlink /var; use the resolved path /private/var/folders/.../provenance/msb/shell-ws-umorpy.3363652959.config or add follow-root-symlinks
acq(msb): error: 'msb create' failed for 'shell-ws-umorpy'.

scripts/verify-backends always hits it on macOS: it puts its hermetic state under $TMPDIR (scripts/verify-backends:203), which is under the /var -> /private/var symlink, and points ACQ_PROVENANCE_DIR there. All three msb sections fail at create (passed: 0 failed: 3).

Reproduce

macOS, msb 0.7.8, main at d7dbeb6:

RUN_ACQ=1 scripts/verify-backends --only msb

With TMPDIR set to its resolved form (/private/var/folders/.../T/) the same run passes 16, skips 1.

Cause

acq.backends/msb.sh builds the --volume "${_hcfg_host}:${ACQ_HOST_CONFIG_GUEST_DIR}:ro" flag from acq_host_config_dir via host_path only, without canonicalize_path, which the workspace mount already uses for this exact macOS case.

Suggested fix

Resolve the directory before mounting it, as the workspace path does:

_hcfg_host=$(host_path "$(canonicalize_path "$_hcfg_dir")")

That fixes the harness and any user whose provenance dir (or XDG_CONFIG_HOME) is reached through a symlink, so verify-backends needs no change.