fix(security): contain external repo file indexing

[bokelley]

Summary

• route every external-repository Markdown read through a contained, no-follow file-descriptor boundary
• reject unsafe patterns, symlinked path components, path escapes, hardlinks, nested Git repositories, special files, oversized documents, and inode swaps
• sanitize the Docker-baked repository cache by deleting and verifying all symlinks before the runtime copy
• add real-filesystem regression coverage across exact, glob, recursive, chain, hardlink, submodule, race, and compatibility cases

Security finding addressed

• codex-security/external-repo-markdown-symlink-disclosure — a tracked Markdown symlink could make Addie index runtime secrets or other local files

Validation

• focused filesystem security tests: 21/21 passed
• server TypeScript no-emit check: passed
• Semgrep: 662 TypeScript targets, 0 findings
• Docker sanitization/order guards: passed
• git diff --check, package/lock, dist, and scope guards: passed
• independent security and testing expert reviews: CLEAN

The reader fails closed where O_NOFOLLOW is unavailable and intentionally caps each external document at 4 MiB. Package metadata and generated artifacts are unchanged.