fix(clean): harden deletion path validation

Reject aliased critical paths and symlinks to protected targets before cleanup reaches deletion helpers. Also keeps safe_find_delete usable when app protection is not loaded and expands path-validation coverage.