fix(pipeline): resolve ../ climbs in tsconfig path alias targets

[apappas1129]

What does this PR do?

Closes #730: tsconfig.json paths aliases that climb out of their config's
directory (e.g. a tsconfig at apps/web/tsconfig.json mapping @shared/*
to ../../packages/shared/src/* — the standard monorepo layout) resolved
to a broken repo-relative path.

resolve_target_relative() in src/pipeline/path_alias.c only stripped a
single leading "./" and otherwise concatenated dir_prefix and target
verbatim, so a ../../ target left literal ".." segments in the
resolved path (e.g. apps/web/../../packages/shared/src/*). That string
never matches a real module's FQN, since cbm_pipeline_fqn_module
tokenizes on / without collapsing .. — so every cross-package import
through such an alias was invisible to the graph and looked like dead
code.

This is also why #308 regressed: the original fix (v0.7.0) handled the
simple "./src" case but never normalized ../ climbs, which is the
pattern monorepos actually use for cross-package aliases.

The fix makes resolve_target_relative() walk the target's path segments
and pop a directory off dir_prefix for each .., mirroring the
normalization cbm_pipeline_resolve_relative_import already does for
plain relative imports in fqn.c.

Checklist

• Every commit is signed off (git commit -s)
• Tests pass locally (make -f Makefile.cbm test) — full suite green
  except one pre-existing, unrelated RSS-ceiling test in
  test_incremental.c (2550MB vs 2048MB limit) on this machine
• Lint passes (make -f Makefile.cbm lint-ci) — could not verify
  locally, cppcheck/clang-format are not installed in this
  environment; relying on CI
• New behavior is covered by a test: added
  path_alias_loader_monorepo_dotdot_climb in tests/test_path_alias.c,
  an end-to-end test with a real tsconfig containing a ../../ alias
  target, asserting the resolved path is correct

[DeusData]

Thanks for the tsconfig path-alias fix for #730. Triage: TypeScript import-resolution correctness.

Review will check that ../ normalization is repo-bounded, cross-platform, and does not allow alias targets to escape into unintended roots. The monorepo alias fixture described in the PR is the right acceptance shape.

[DeusData]

Thank you — correct fix at the correct layer. We verified the segment-walk clamps at repo root (no traversal possible) and that the resolved string only ever feeds graph-QN resolution, never filesystem I/O; the allocation sizing is tight but exact. The red-first monorepo test seals it. Merging. Your issue write-ups on this series are a pleasure to review.