fix(delegation): the sibling rule pairs with the registry's real path (Issue #57, Mac R2)

A registry directory that is itself a symlink got two audit logs: submit
resolved --registry-dir with pwd -P and wrote next to the target, while logs
derived the sibling from the link path. sibling_logs_dir() now takes the
registry's realpath; an explicit DELEGATE_JOB_LOGS_DIR still wins.
Also: forwarded_keys() normalises both sides of its comparison, and the
design doc's status row lists the audit log next to the registry.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

tests/test_issue57_logs_follow_registry.py

@@ -599,3 +599,35 @@ def test_disk_fallback_rejects_a_terminal_that_belongs_to_a_later_dispatch(moved
     pending, terminal = {jid}, {}
     job_subscriber._check_disk_fallback(pending, str(reg), terminal, {jid: tok_a}, {jid: 1})
     assert pending == {jid} and terminal == {}
+
+
+# ---------------------------------------------------------------------------
+# Mac review R2: a registry directory that is itself a symlink has one audit log
+# ---------------------------------------------------------------------------
+
+def test_a_symlinked_registry_dir_resolves_to_one_audit_log(tmp_path, monkeypatch):
+    """submit resolves --registry-dir with pwd -P, so its audit log lands next
+    to the link's target; the resolver must pair the same place for logs."""
+    from lib_py.delegation import logroot
+    for k in DROP:
+        monkeypatch.delenv(k, raising=False)
+    ws = tmp_path / "ws"
+    (ws / ".mam").mkdir(parents=True)
+    monkeypatch.setenv("WORKSPACE_ROOT", str(ws))
+    actual = tmp_path / "actual" / "jobs"
+    actual.mkdir(parents=True)
+    alias = tmp_path / "alias"
+    alias.mkdir()
+    (alias / "jobs").symlink_to(actual)
+    real_actual = Path(os.path.realpath(tmp_path / "actual"))
+    assert logroot.sibling_logs_dir(str(alias / "jobs")) == str(real_actual / "delegate_job_logs")
+    res = _wrapper(ws, "submit", "--dry-run", "--agent", "human", "--registry-dir", str(alias / "jobs"),
+                   "--workdir", str(ws), "--prompt", "t")
+    assert res.returncode == 0, res.stdout[-800:] + res.stderr[-800:]
+    jid = _only_job_id(actual)
+    assert res.stdout.strip().splitlines()[-1] == str(real_actual / "delegate_job_logs" / jid)
+    assert (real_actual / "delegate_job_logs" / jid / "meta.json").is_file()
+    assert not (tmp_path / "alias" / "delegate_job_logs").exists()
+    res = _wrapper(ws, "logs", "--registry-dir", str(alias / "jobs"), jid)
+    assert res.returncode == 0 and "registered" in res.stdout, res.stdout + res.stderr
+    assert not (ws / ".mam" / "delegate_job_logs").exists()