fix(brainfs): bound the read in ReadRegularMax; honest test names (#157)

Review round 1 on PR #165:

- ReadRegularMax checked the size on the opened handle, then read with an
  unbounded io.ReadAll, so a file growing after the check returned past the
  limit. The read now goes through io.LimitReader(max+1). A test seam grows
  the file between the check and the read and counts bytes consumed.
- New: ReadScoped returns ErrTooLarge for a note over maxNoteBytes; red if
  readContained drops the limit.
- notes.Target carries the brain root instead of deriving it by TrimSuffix.
- Rule 9: reader tests renamed to <Reader>RefusesSymlinksAndSurvivesSwapRaces;
  ReadNote test has a positive control; brainfstest comment states what the
  harness observes and what it does not.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/internal/notes/edit.go

@@ -75,8 +75,7 @@ func readContained(t Target) ([]byte, error) {
 	// Through the brain root, regular files only, size checked on the opened
 	// handle (hyperguild#157): Resolve's Lstat could be raced by a swap, and
 	// os.ReadFile blocked on a FIFO.
-	brainDir := strings.TrimSuffix(t.Abs, string(filepath.Separator)+filepath.FromSlash(t.Rel))
-	bfs, err := brainfs.Open(brainDir)
+	bfs, err := brainfs.Open(t.Brain)
 	if err != nil {
 		return nil, fmt.Errorf("notes: %w", err)
 	}