wizard: write_env follow-ups from the #6275 verification (symlinked parent dir, key refusal gaps) #6391

Follow-ups from a fresh-context security verification of #6275 at 8a2c8c7 (plugins/wizard/skills/generate/template.sh). The verifier rated the PR ship; none of these block it.

1. Medium: a symlinked parent directory bypasses the outside-project prompt. _check_env_target checks only the final path component for a symlink. With ENV_FILE=sub/.env where sub links to a directory outside the project, write_env writes through without asking. The default .env is unaffected. Fix: resolve the full path (parent directory included) before the inside-project test.
2. Low: the drift test does not derive every global. Its grep skips indented assignments, so the colour globals (BOLD and the rest) are hardcoded in the refusal list rather than derived from the library.
3. Low: refusal tests pass vacuously on code without the function. A missing function also exits non-zero, so on the pre-fix code only the ordinary-key accept test failed. Assert the refusal message, not just the exit code.
4. Low: shell special variables are accepted as keys. PATH, IFS and similar are not refused by _assignable_key.