fix(ops): address provenance gate review findings

Co-authored-by: genichin <4282227+genichin@users.noreply.github.com>

trex_core/adapters/persistence/ops_checks.py

@@ -98,9 +98,10 @@ def _sha256_bytes(payload: bytes) -> str:
 
 
 def _resolve_under(root: Path, relpath: str) -> Path | None:
-    candidate = (root / relpath).resolve()
+    resolved_root = root.resolve()
+    candidate = (resolved_root / relpath).resolve()
     try:
-        candidate.relative_to(root)
+        candidate.relative_to(resolved_root)
         return candidate
     except ValueError:
         return None