wedge: local adapter resolves dest symlinks before home containment check

Found by the T036 gate install on m2bd-m2o: $HOME is a bind of
/agent_home/home/developer; Path.home().resolve() followed the mount while the
expanded dest did not, false-positiving the safety guard. The failed install
correctly auto-refunded (the FR-005 compensation path proved itself live).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

cli/src/m2_market/apply/local.py

@@ -151,6 +151,11 @@ class LocalApplyAdapter:
         if not dest.is_absolute():
             dest = home / dest
         dest = Path(os.path.normpath(str(dest)))
+        # Resolve symlinked/bind-mounted ancestors so the containment check
+        # compares real paths: on m2o desktops $HOME (/home/developer) is a
+        # mount of /agent_home/home/developer, and Path.home().resolve()
+        # already followed it — an unresolved dest would false-positive here.
+        dest = dest.resolve()
 
         if dest != home and home not in dest.parents:
             raise ValueError(