test: Add outputs path-traversal negative-case regression tests (#13300)
## Why
The `..` traversal rejection for `outputs` (#13290) and the
symlink-escape handling (#13076, #13166) already landed. While verifying
them I found a few cases those PRs did not assert. These are test-only
additions, no behavior change.
## What
- dotdot look-alike literals that must NOT be over-rejected: `%2e%2e/`,
full-width dots, `..\`, `~/`
- a leading absolute path in `outputs` errors as `AbsolutePathInConfig`
- negated outputs inside an incremental partition still reject traversal
## Notes
- Verified `..` traversal and symlink-escape are already fully handled
on main, so no production change is needed
- One related follow-up worth a separate look: incremental input hashing
globs and reads files the same way and is not covered by the output
symlink guard. Lower severity since contents are hashed, not stored or
restored
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>