resolve_ref(): explicitly fail if a symlink is not readable