fix: generated and promoted writes go through the brain root (#188, #158)

Writers that created or rewrote brain files by path followed symlinks:
- promote/reject: os.MkdirAll + os.WriteFile of the destination, then
  os.Remove of the raw source. Now PutRegular + brainfs.Remove; the source
  is kept when the write is refused.
- StampProvenanceFile (brain_edit's re-stamp): provenance.ApplyFile read
  and rewrote by path. Now ReadRegular + WriteRegular; ApplyFile, now
  unused, is removed.
- BuildWingIndex (_index.md) and wiki.RebuildIndex (wiki/index.md): now
  PutRegular.
- wiki.AppendLog (log.md) and AutoTunnel's fuzzy-candidate log
  (raw/tunnel-candidates-*.md): now AppendRegular; tunnel's fileExists,
  now unused, is removed.
- New brainfs.Remove: clean path, real parent, removes a final symlink
  itself, never its target.

brain_edit's own atomic rename was already refused behind a symlinked
directory by #187's read check; a guard test pins it.

Pipeline writes, BackfillRefs, the watcher's raw/ markers and the session
archive in cmd/server follow in a separate PR (#158).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/internal/brainfs/brainfs.go

@@ -204,6 +204,16 @@ func (b *Brain) AppendRegular(rel string, data []byte) error {
 	return f.Close()
 }
 
+// Remove removes the file at a clean brain-relative path through the root,
+// refusing a path behind a symlinked directory. A final symlink is removed
+// itself, never its target.
+func (b *Brain) Remove(rel string) error {
+	if err := b.RealParent(rel); err != nil {
+		return err
+	}
+	return b.root.Remove(rel)
+}
+
 // RealParent returns ErrNotRegular unless rel is clean and every directory
 // above it is a real directory, for writers that do their own I/O (an atomic
 // rename) but must not be redirected by a symlinked directory.