fix(brainfs): bound the read in ReadRegularMax; honest test names (#157)

Review round 1 on PR #165:

- ReadRegularMax checked the size on the opened handle, then read with an
  unbounded io.ReadAll, so a file growing after the check returned past the
  limit. The read now goes through io.LimitReader(max+1). A test seam grows
  the file between the check and the read and counts bytes consumed.
- New: ReadScoped returns ErrTooLarge for a note over maxNoteBytes; red if
  readContained drops the limit.
- notes.Target carries the brain root instead of deriving it by TrimSuffix.
- Rule 9: reader tests renamed to <Reader>RefusesSymlinksAndSurvivesSwapRaces;
  ReadNote test has a positive control; brainfstest comment states what the
  harness observes and what it does not.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/internal/brainfs/brainfstest/brainfstest.go

@@ -1,8 +1,9 @@
-// Package brainfstest is the shared harness for hyperguild#157's behavioural
-// confinement tests: it keeps swapping a regular note, a symlink to an
-// outside file, or a FIFO (with a writer held open) into a path while a
-// reader under test loops. A reader is confined if no sentinel byte ever
-// reaches its output and it never hangs.
+// Package brainfstest is the shared harness for hyperguild#157's swap-race
+// tests: it keeps swapping a regular note, a symlink to an outside file, or a
+// FIFO (with a writer held open) into a path while a reader under test loops.
+// It observes two things: no sentinel byte from the outside file reaches the
+// reader's output, and the reader returns within a timeout. It does not cover
+// hard links, other paths into the reader, or races it does not generate.
 package brainfstest
 
 import (