fix(cli): resolve symlink chain so global installs find the package dir (v2.8.1)

[aldegad]

Problem

npm i -g @aldegad/safedeps (and ~/.local/bin via the installer's --link-bin) put a file symlink at <prefix>/bin/safedeps. ${BASH_SOURCE[0]} kept that symlink path, so dirname/.. resolved to the node prefix and every command died at:

bin/safedeps: line 18: <prefix>/lib/providers/providers.sh: No such file or directory

Reproduced verbatim against the npm global layout. Hooks were unaffected (they run through the skill's directory symlink, where cd .../scripts && pwd already lands in the real repo).

Fix

Walk the symlink chain to the real script before deriving the repo dir — a portable readlink + cd -P loop (not readlink -f, which is non-portable on macOS). Zero-dep preserved.

Tests

• Regression smoke test: invokes the CLI through an npm-style global file symlink (relative symlink + package under lib/node_modules). Verified it fails on the pre-fix bootstrap with the exact reported error and passes after.
• npm test (smoke + e2e) green; shellcheck --severity=error clean.

Docs

• ROADMAP: added the missing v2.8 section (v2.8.0 adversarial re-audit + this v2.8.1 fix); EN SSoT + KO mirror.
• Logged pnpm/yarn lockfile audit as a v3 gap (safedeps audit is npm-lockfile-only → exit 2 on pnpm/yarn).

Version bumped 2.8.0 → 2.8.1 (package.json + bin/safedeps SSoT).