Permission rules: $HOME not expanded during startup validation when checking symlinked config

Issue

During startup validation, Claude Code resolves symlinks to their absolute paths before evaluating permission rule variables. This causes $HOME to not be expanded in permission rules when the target is a symlink.

Current Behavior

Permission rule:

Read($HOME/cloud/shared-source/Claude/proj_template/**)

Results in permission prompt for reading ./.claude/settings.json (which is symlinked to that path) because the symlink is resolved to /Users/jaclu/cloud/shared-source/... first, then checked against the rule containing the literal string $HOME/....

Workaround

Must use explicit absolute paths for each platform:

Read(//Users/jaclu/cloud/shared-source/Claude/proj_template/**)
Read(//home/jaclu/cloud/shared-source/Claude/proj_template/**)

This violates single-point-of-truth principle when config is shared across platforms via symlinks.

Expected Behavior

Permission rule variables like $HOME should be expanded before or during symlink resolution, not after, so they work consistently for symlinked config files.