fix: preserve snapshot symlinks and guard incomplete upgrade copies

internal/api/snapshot_download.go

@@ -62,13 +62,7 @@ func snapshotArchive(ctx context.Context, root *os.Root, out io.Writer, limit in
 			if err != nil {
 				return err
 			}
-			if filepath.IsAbs(link) || !filepath.IsLocal(filepath.Join(filepath.Dir(rel), link)) {
-				return errUnsafeSnapshotArchive
-			}
-			// Root resolution also catches escapes through chains of relative links.
-			if _, err = root.Stat(rel); err != nil && !errors.Is(err, os.ErrNotExist) {
-				return errUnsafeSnapshotArchive
-			}
+			// Archive link text only; do not read or traverse its target.
 		} else if !st.IsDir() && !st.Mode().IsRegular() {
 			return errUnsafeSnapshotArchive
 		}