Don’t expand symlinks in update

Summary

This fixes a race condition where a “git push” builds correctly but fails to update. $GIT_DIR/builds/<rev>/ will exist and be a symlink to the Nix store. “realpath” resolves those symlinks by default. So, this results in error messages from Nix like this:

error: creating a garbage collector root (/nix/store/a7mg5qy0szdabjjmr25sjifhmgzy2yvg-nixos-system-dellbook-20.03pre-git) in the Nix store is forbidden (are you running nix-build inside the store?)

This can be fixed with realpath’s -s flag.

Merge criteria

(Please make a note here of any dependencies on other open merge requests, or any other blockers that must be dealt with before anyone should hit the "Merge" button. Delete this comment if there are none.)

• All merge requests must be reviewed by someone other than the original author.
• Before hitting the "Merge" button, verify that the associated CI build has succeeded or that the source branch can be built with a manual nix-build.

Checklist for success

• I have updated the changelog.
• My code is consistent with the Obsidian style guide.