Motivation & Context

FileSystemAgentFileStore promises root-scoped access and rejects linked or reparse paths during direct operations, but its directory listing and recursive search paths only checked Path.is_symlink(). On Windows, directory junctions are reparse points that do not report as symlinks, so file_access_grep could descend outside the configured root.

Description & Review Guide

• What are the major changes? Add a shared link and reparse-point predicate using lstat(), POSIX link mode, Path.is_junction() when available, and the Windows reparse attribute fallback. Apply it to direct path validation, directory listing, and recursive search, and add a Windows regression test with a real directory junction.
• What is the impact of these changes? FileSystemAgentFileStore now consistently omits symlinks, junctions, and other reparse points from listing and search, preventing recursive file access from crossing the configured root. Existing regular-file behavior and public APIs are unchanged.
• What do you want reviewers to focus on? The cross-version Windows reparse detection and fail-closed behavior when an entry cannot be inspected.

Related Issue

Fixes #7290

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add [BREAKING] to the title prefix, before or after any language prefix) - a workflow keeps the label and title prefix in sync automatically.