fix(watcher): never walk into raw/rejected/ — it was auto-publishing declined notes

Review of PR #133 found a serious bug: the file watcher's processDir
walks brain/raw/ with filepath.WalkDir (recurses by default) and only
skipped processed/ and failed/ by name. brain_reject moves a declined
note to raw/rejected/, which the watcher had no reason to know about --
so on its next tick (30s default), it picked the note back up, ran it
through the full LLM extraction pipeline, and published it into the
wiki. A human's explicit "not worth promoting" decision was silently
reversed by a background job 30 seconds later. Reproduced directly:
flip-testing the fix back out shows the watcher's own log line, "file
processed file=declined-file.md", proving this wasn't hypothetical.

Fixed by adding "rejected" to the same subdirectory skip-list
processed/failed already use. Checked the other two consumers of raw/
content for the same class of bug and found neither is affected:
graphsync.BackfillFromBrainDir only walks wiki/ and knowledge/; search's
resolveRoots only ever returns knowledge/ and wiki/. Neither touches
raw/ at all, rejected or not.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

ingestion/internal/watcher/watcher.go

@@ -59,10 +59,16 @@ func processDir(ctx context.Context, cfg Config, date string) []error {
 			return nil
 		}
 
-		// Skip processed/ and failed/ subdirectories entirely.
+		// Skip processed/, failed/, and rejected/ subdirectories entirely.
+		// rejected/ (hyperguild#81, brain_reject) holds notes a human already
+		// looked at and declined — walking into it would run the extraction
+		// pipeline over a note and publish it to the wiki, the exact opposite
+		// of the human's decision. The whole reason RejectNote moves a note
+		// there instead of leaving it in raw/ was to keep it out of every
+		// path that treats raw/ as "awaiting processing" — this is that path.
 		if d.IsDir() {
 			name := d.Name()
-			if name == "processed" || name == "failed" {
+			if name == "processed" || name == "failed" || name == "rejected" {
 				return filepath.SkipDir
 			}
 			return nil