The symlink checks stopped at the mount root, so a mount root that was itself
a symlink (e.g. themes/mytheme/assets -> /somewhere/else) was followed. This
closes that gap in the themes/ confinement, which is the primary motivation.
For simplicity this applies to project mounts as well; one motivation behind
Hugo's mount setup was to remove the need for symlinks, and absolute mount
sources are still allowed there.
Thanks to @DONG2209 for finding and reporting this issue.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>