cook: resolve symlinks before the tracked-source check

The out-of-tree staging added in 221a91cba4 never actually ran. Recipes are
reached through the overlay path `recipes/<cat>/<name>`, a symlink into
`local/recipes/...`, and `git ls-files --error-unmatch` refuses any pathspec
that traverses a symlink ("pathspec is behind a symbolic link"). The check
therefore reported every tracked vendored tree as untracked, staging was
skipped, and builds went on mutating git-tracked sources -- 22 dirty source
files after a 42-package run.

Canonicalize the path before both the git query and the copy. Verified: the
check fails via the symlink, succeeds via the resolved path, and cooking
kirigami now logs

  [out-of-tree] staged tracked source -> .../kirigami/target/.../source-staged

with the recipe's sed rewriting the staged copy instead of the tracked tree.

src/cook/cook_build.rs

@@ -979,11 +979,19 @@ pub fn build(
             // Only tracked trees are staged. Tarball-extracted sources are
             // untracked and disposable, and copying them would add cost for no
             // safety. Escape hatch: REDBEAR_IN_TREE_BUILD=1.
+            // Resolve symlinks BEFORE asking git. Recipes are reached through
+            // the overlay path `recipes/<cat>/<name>` which is a symlink into
+            // `local/recipes/...`, and `git ls-files --error-unmatch` refuses
+            // any pathspec that traverses a symlink ("pathspec is behind a
+            // symbolic link"). Passing the unresolved path made every tracked
+            // vendored tree look untracked, so staging silently never fired and
+            // builds kept mutating the git-tracked source.
+            let source_real = source_dir.canonicalize().unwrap_or_else(|_| source_dir.to_path_buf());
             let source_is_tracked = std::env::var_os("REDBEAR_IN_TREE_BUILD").is_none()
                 && Command::new("git")
                     .arg("ls-files")
                     .arg("--error-unmatch")
-                    .arg(source_dir)
+                    .arg(&source_real)
                     .stdout(Stdio::null())
                     .stderr(Stdio::null())
                     .status()
@@ -996,7 +1004,7 @@ pub fn build(
                 let status = Command::new("cp")
                     .arg("-a")
                     .arg("--reflink=auto")
-                    .arg(source_dir)
+                    .arg(&source_real)
                     .arg(&staged)
                     .status()
                     .map_err(|e| format!("failed to stage source out of tree: {e}"))?;