Resolve module paths consistently through symlinks

internal/releaseidentity/identity.go

@@ -51,11 +51,9 @@ func ResolveSelection(repositoryDir, moduleDir string) (Selection, error) {
 	if err != nil {
 		return Selection{}, fmt.Errorf("resolve repository directory %q: %w", repositoryDir, err)
 	}
-	moduleAbs, err := filepath.Abs(filepath.Join(repositoryAbs, moduleDir))
-	if err != nil {
-		return Selection{}, fmt.Errorf("resolve module directory %q: %w", moduleDir, err)
-	}
-	moduleAbs, err = filepath.EvalSymlinks(moduleAbs)
+	// Preserve components until symlinks are followed, so link/.. uses the
+	// linked directory's parent just as committed path traversal does.
+	moduleAbs, err := filepath.EvalSymlinks(repositoryAbs + string(filepath.Separator) + moduleDir)
 	if err != nil {
 		return Selection{}, fmt.Errorf("resolve module directory %q: %w", moduleDir, err)
 	}