mcp: make cbm_path_within_root parseable without the preprocessor

[DeusData]

Problem

cbm_path_within_root (the containment guard every MCP file-read sink passes through) was missing from the code knowledge graph — despite its callers being present. Root cause: its definition used

#ifdef _WIN32
    if (_fullpath(...) && _fullpath(...)) {   // opening brace in the WIN32 branch
        ...
#else
    if (realpath(...) && realpath(...)) {     // a different opening brace in the POSIX branch
#endif
        ...shared body...
    }                                         // single shared close brace

That's legal C, but the #ifdef splits the function body's braces across preprocessor branches. A source-level parser that runs without the preprocessor (the tree-sitter-based indexer) sees two if { opens and one } close → unbalanced → error node → no Function node emitted.

Change

Extract a tiny per-OS resolve_canonical_path() helper (each #ifdef branch is now a complete statement), leaving cbm_path_within_root with one unconditional if. Purely structural — behavior is identical.

Verification

• mcp_path_within_root_rejects_escape and path_within_root_allowed still pass; full C build + lint clean.
• Re-indexed the tree: cbm_path_within_root now appears as a Function node with in_degree=6 (all callers resolve to it), and the new resolve_canonical_path helper is linked. Before this change it was absent from the graph entirely.

The general extractor limitation (functions whose braces are split by #ifdef) is tracked separately as an issue; this PR fixes the one security-relevant function and removes a genuine code smell.