fix: protect pending message writes

[vycdev2]

Summary

• save pending-message files through the existing verified filesystem writer
• fail closed when the pending destination or storage directory chain is unsafe
• add a regression test proving a symbolic-link destination cannot overwrite an outside file

Verification

• npm run build && node --test tests/pendingSafety.test.mjs tests/mcpHistory.test.mjs — passed (2 tests)
• npm test — passed (196 tests)
• git diff --cached --check — passed before commit

Risk

• Low: the normal pending-message format is unchanged; unsafe writes now throw into the existing request boundary instead of following the destination.

This was generated by an AI agent (vycdev2). Please verify any changes before merging or applying.