fix(release): canonicalize macOS smoke paths

[drewstone]

Change

• Resolve the private temporary directory to its physical path before installed storage use.
• Keep the protected-storage symlink rejection unchanged.
• Lock the release-script invariant in the contract test.

Direct use

• Reproduced the release failure on macOS: SAFE_FILE_SYMLINK at /var.
• Built and installed the exact 0.1.1 package locally through a symlinked TMPDIR.
• Completed its plain CLI flow and encrypted SQLite write/replay.
• Unit tests: 229/229 passed. Lint and typecheck passed.