#21935: fix: handle symlinked media roots in local media checks

## Summary - Fix local media path allowlist checks in `src/web/media.ts` to handle symlinked roots correctly. - Ensure `/tmp`-based paths are accepted when the root resolves through another canonical path (e.g. `/tmp` <-> `/private/tmp`). - Preserve existing security hardening: explicit `localRoots`, `path-not-allowed`, and filesystem-root rejection remain enforced. ## Why CI had failures like: - `Local media path is not under an allowed directory: /tmp/...` `assertLocalMediaAllowed` previously validated against a single root representation and could reject valid temp files in symlink-heavy environments. ## Notes - This PR is now based on branch `fix/gateway-probe-resilience` and includes the earlier gateway probe resilience commit plus this local-media hardening fix.