Function resolve_real_binary 

pub fn resolve_real_binary(path: &Path) -> PathBuf

Follows symlinks and shell-script shim exec targets to find the real ELF binary. Shim wrappers (like ~/.graphrag-shim/codex) can strip hardening flags; bypassing them is a security requirement.