Cursor caught a consequence of moving the shared-home guard after path
resolution: the missing-target check ran first, so a shared home with no
database yet got "start the dev server (`bun run dev`), then seed" —
advice that creates the database in the shared home and walks the user
into the exact write the guard refuses.

The refusals run first again. That surfaced why the previous ordering
existed: realPath fails on a missing final component, and falling back
to the literal path would lose symlink resolution precisely when the bad
advice would be given. Canonicalize the directory and re-join the
filename instead, so a symlinked state dir is resolved whether or not
the database behind it exists yet.

Verified all three ways: a shared home without a database is refused as
shared-home, a symlinked base without a database behind it is refused as
shared-home, and a legitimate empty target still gets the missing-target
hint.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>