Fix first-run plstore path validation

[telotortium]

Summary

• recognize identical canonical plstore paths before falling back to file-equal-p
• preserve the safety error when secret entries are actually inserted into a different buffer
• add ERT coverage for missing files, symlinked parent directories, hard links, and wrong-buffer rejection
• replace the placeholder test target with compilation, Checkdoc, and ERT execution
• add an Emacs 26.1 through snapshot GitHub Actions matrix
• reflow the manual-authentication docstring so the existing Checkdoc target passes

Root cause

file-equal-p returns nil when its target does not exist, even when both arguments name the same path. On the first OAuth save, the safety guard therefore misclassified the new plstore buffer as an unrelated file. Pre-creating an empty file made the workaround succeed only because file-equal-p could then compare filesystem identity.

Impact

First-time authentication can create the plstore normally without requiring users to pre-create an empty file, while the protection against writing secrets into Org or other unrelated buffers remains active.

This addresses the first-run failure and workaround reported in #6.

Validation

• make all
• 6 ERT tests pass
• byte-compilation and Checkdoc pass
• GitHub Actions workflow YAML parses successfully