fix(brain): context, brain_get and brain_read read through brainfs (#157, slice 2) (#165)

readExcerpt, ReadNote and ReadScoped now read through brainfs (os.Root, regular files only, type checked on the opened handle), so a symlink swapped in after a check is not followed and a FIFO does not hang the reader. ReadRegularMax bounds the read itself with io.LimitReader(max+1). notes.Target carries the brain root.

Refs #157. Adversarial review round 2: PASS (round 1 BLOCKED: unbounded read, rule-9 test names).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Mathias <mthbqv@gmail.com>

ingestion/internal/api/readnote_root_test.go

@@ -0,0 +1,43 @@
+package api_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
+	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
+)
+
+// hyperguild#157 slice 2: ReadNote (brain_get, read-after-write) read by
+// path; it now reads through brainfs.
+func TestReadNoteRefusesSymlinksAndSurvivesSwapRaces(t *testing.T) {
+	brain := t.TempDir()
+	facts := filepath.Join(brain, "wiki", "w", "facts")
+	require.NoError(t, os.MkdirAll(facts, 0o755))
+	require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(facts, "leak.md")))
+	_, body, _, err := api.ReadNote(brain, "wiki/w/facts/leak.md")
+	assert.Error(t, err)
+	assert.NotContains(t, body, brainfstest.Sentinel)
+
+	p := filepath.Join(facts, "r.md")
+	require.NoError(t, os.WriteFile(p, []byte("---\nx: y\n---\ninside"), 0o644))
+	fm, body, _, err := api.ReadNote(brain, "wiki/w/facts/r.md")
+	require.NoError(t, err)
+	assert.Equal(t, "y", fm["x"])
+	assert.Contains(t, body, "inside")
+	read := func() string {
+		fm, body, _, _ := api.ReadNote(brain, "wiki/w/facts/r.md")
+		s := body
+		for k, v := range fm {
+			s += k + v
+		}
+		return s
+	}
+	brainfstest.AssertNoLeak(t, p, "---\nx: y\n---\ninside", 1500*time.Millisecond, read)
+	brainfstest.AssertNoHang(t, p, "---\nx: y\n---\ninside", 1500*time.Millisecond, 6*time.Second, func() { _ = read() })
+}