feat(gptel-tools): harden path validation with file-truename realpath

Resolves PATH through file-truename before applying home-directory and
read/write checks across the path-handling tools (git_status, git_log,
git_diff, move_to_trash, read_text_file, update_text_file,
write_text_file, list_directory_files, read_buffer, web_fetch).
Without the resolve step, a symlink under HOME pointing outside HOME
would pass the prefix check but the tool would act on the real target
-- a symlink-escape.

move_to_trash also tightens the trash-bin construction (treats empty
file extensions correctly) and switches the "critical directories"
list to truename-resolved canonical forms so a symlinked ~/.config
can't be trashed via an aliased path.

update_text_file fixes an off-by-one in the line-count derivation
when the source content is empty.

Each source change pairs with tests in tests/test-gptel-tools-*.el
and tests/test-update-text-file.el covering the realpath escape
paths, the empty-extension trash case, and the empty-content line-
count edge.  Combined coverage is now 100% across all ten gptel-tools
source files: 516 / 516 executable lines, 217 tests.

1 files changed, 1 insertions, 1 deletions

diff --git a/gptel-tools/web_fetch.el b/gptel-tools/web_fetch.el
index 1f950a31..b2f80c5f 100644
--- a/gptel-tools/web_fetch.el
+++ b/gptel-tools/web_fetch.el
@@ -62,7 +62,7 @@ from the response status line, or nil when the line is unrecognized."
           (let* ((status (when (re-search-forward
                                 "^HTTP/[0-9.]+ \\([0-9]+\\)" (point-max) t)
                            (string-to-number (match-string 1))))
-                 (body-start (when (re-search-forward "\n\n" nil t)
+                 (body-start (when (re-search-forward "\r?\n\r?\n" nil t)
                                (point))))
             (cons status
                   (if body-start