Merge current Backend main into project decision work

Why: Integrate Backend origin/main 7aa6243 while retaining the product's mandatory trusted project-context startup contract.

Evidence: go test ./pkg/extension/... ./internal/app -count=1; go vet ./...; go test ./... -count=1; go build ./...; CGO_ENABLED=0 go build ./cmd/agent-system.

Impact: Keep the appOptions helper and exec-environment fallbacks while forwarding RequireProjectContext without loss.

Refs: 92f9286e6c4004074f014902f8b04554287ddfb2; 7aa624370a

cmd/agent-system/env.go

@@ -6,6 +6,7 @@ import (
 	"flag"
 	"fmt"
 	"os"
+	"path/filepath"
 	"time"
 
 	"agent-system-backend/internal/execenv"
@@ -137,6 +138,9 @@ func runDoctor(ctx context.Context, root *execenv.Root, py string, sandbox bool)
 	if prefix := root.PythonPrefix(); prefix != "" {
 		mounts = append(mounts, prefix)
 	}
+	if resolved, err := filepath.EvalSymlinks(py); err == nil {
+		py = resolved
+	}
 	if err := execenv.Doctor(ctx, py, pyPath, nil, sandbox, mounts); err != nil {
 		fmt.Fprintln(os.Stderr, "env doctor:", err)
 		return 1