fix(brainfs): check every component of the walk root (#157)

Review round 2 on PR #166: Lstat on the walk root checks only its last
component, so search with Wing+Hall (root wiki/<wing>/<hall>) walked a
symlinked <wing> whose target had a real <hall> directory.

WalkRegular now Lstats every prefix of the root and requires each to be
a real directory. New brainfs and search (Wing+Hall) tests; the Wing-only
search test is renamed to say what it covers.

The doc now records the accepted residual: a directory swapped for a
symlink between listing and read is still followed; os.Root keeps the
read inside the brain but not inside the walk root.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/internal/search/brainroot_test.go

@@ -64,7 +64,7 @@ func TestQueryDoesNotFollowASymlinkedDirectory(t *testing.T) {
 // A search root that is a symlink staying inside the brain (wiki/<w> -> ..)
 // was followed by fs.WalkDir, aliasing raw/ and root files into results
 // (PR #166 review). The root is now Lstat-checked and skipped.
-func TestQueryDoesNotFollowASymlinkedSearchRootInsideTheBrain(t *testing.T) {
+func TestQueryDoesNotFollowASymlinkedWingRootInsideTheBrain(t *testing.T) {
 	brain, _, _ := searchBrain(t)
 	require.NoError(t, os.MkdirAll(filepath.Join(brain, "raw"), 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(brain, "raw", "r.md"), []byte("# r\n\nzqrawonly"), 0o644))
@@ -74,6 +74,18 @@ func TestQueryDoesNotFollowASymlinkedSearchRootInsideTheBrain(t *testing.T) {
 	assert.Empty(t, rs)
 }
 
+// With a hall the search root is wiki/<wing>/<hall>; a symlinked <wing> with
+// a real <hall> directory under its target was followed (PR #166 round 2).
+func TestQueryDoesNotFollowASymlinkedWingUnderAWingAndHallRoot(t *testing.T) {
+	brain, _, _ := searchBrain(t)
+	require.NoError(t, os.MkdirAll(filepath.Join(brain, "raw", "facts"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(brain, "raw", "facts", "r.md"), []byte("# r\n\nzqrawhall"), 0o644))
+	require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(brain, "wiki", "alias")))
+	rs, err := Query(brain, QueryOptions{Query: "zqrawhall", Wing: "alias", Hall: "facts", Limit: 10})
+	require.NoError(t, err)
+	assert.Empty(t, rs)
+}
+
 // swapInto keeps renaming a regular note, and either a symlink to outside or
 // a FIFO, into path. Each FIFO has a writer held open (as any local process
 // can): a FIFO with no writer reads EOF at once, which would let a reader