fix(ingestion): close the PR #156 review findings on raw/ reads

- Reverting the ingest call sites to extract.Text(path) stayed green;
  a test now fails if anything outside internal/extract calls
  extract.Text( (only TextIn, through an os.Root, may be used).
- The watcher symlink test passed for a watcher that ingested nothing,
  or stopped at the first symlink (SkipAll: one synced link halting all
  ingestion). It now plants a real note after the symlink and asserts
  exactly one ingest, and the symlinked-raw refusal has its own test.
- A FIFO swapped in between Lstat and Open hung open(2) forever.
  extract.OpenRegular opens non-blocking and checks the type on the
  handle; readRawNote, TextIn and the watcher's archive copy use it.
- The symlinked-root test covers pending, promote, reject, resolve and
  ReadIngestFile, and is named for exactly those.
- The hard-link residual is documented where it is accepted.

Out of scope, filed: #157 (symlinks elsewhere in the Syncthing-shared
brain dir reach search and other readers), #158 (writes under raw/
follow symlinks).

Refs #153

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/internal/api/rawroot.go

@@ -6,6 +6,8 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+
+	"github.com/mathiasbq/hyperguild/ingestion/internal/extract"
 )
 
 // errNotANote is returned for a raw/ entry that is not a regular file — in
@@ -38,6 +40,12 @@ func OpenRawRoot(brainDir string) (*os.Root, string, error) {
 
 // readRawNote reads one raw/ entry by basename through the root, refusing
 // anything that is not a regular file.
+//
+// Accepted residual: a HARD link to an outside file is a regular file and is
+// read. Syncthing syncs contents, not links, so a peer cannot create one;
+// fs.protected_hardlinks=1 and the pod's secrets live on a different
+// filesystem from the brain volume, so a local caller cannot link them in.
+// Refusing Nlink > 1 is the next step if either assumption changes.
 func readRawNote(r *os.Root, base string) ([]byte, os.FileInfo, error) {
 	fi, err := r.Lstat(base)
 	if err != nil {
@@ -46,7 +54,7 @@ func readRawNote(r *os.Root, base string) ([]byte, os.FileInfo, error) {
 	if !fi.Mode().IsRegular() {
 		return nil, nil, errNotANote
 	}
-	f, err := r.Open(base)
+	f, _, err := extract.OpenRegular(r, base)
 	if err != nil {
 		return nil, nil, err
 	}