fix(agent/agentcontext): canonicalize scan root in symlink boundary check (#26175)

agent/agentcontext/paths_test.go

@@ -10,6 +10,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/coder/coder/v2/agent/agentcontext"
+	"github.com/coder/coder/v2/testutil"
 )
 
 // switchHomeEnv overrides the platform-specific environment
@@ -99,7 +100,7 @@ func TestValidateSourcePath_RejectsParentSegments(t *testing.T) {
 
 func TestValidateSourcePath_AllowsInsideRoot(t *testing.T) {
 	t.Parallel()
-	dir := t.TempDir()
+	dir := testutil.TempDirResolved(t)
 	child := filepath.Join(dir, "child")
 	require.NoError(t, os.MkdirAll(child, 0o755))