Harden instruction-source containment and fail-closed reads

[LE0-Lin]

Summary

Harden instruction discovery and reads without expanding the score model:

• Selected instruction sources and .agentconfigscoreignore must resolve to in-repository regular files. Keep valid internal file aliases and their discovered report locations, Markdown-link bases and instruction scopes.
• Validate selected sources during discovery and again before reading, then read the resolved target. External/dangling/cyclic/non-regular sources and actual content-read failures become operational errors, not skipped files or partial lint scores. Raw target/error details are not echoed.
• Use pruned, non-following directory discovery, including Windows junction handling, while preserving caller root aliases, canonical case preference and ignore-glob meaning.
• Doctor checks actual instruction-source readability. Retain legacy read-error metadata for historical reports/config compatibility; it cannot suppress operational failures. Unrelated metadata link cycles do not crash path indexing.

Verification

• Reproduced external-source reads, silently skipped broken sources, loop tracebacks and incomplete-read scores before the fix.
• Full local suite: 321 tests completed; 3 platform-specific skips; all remaining tests passed.
• Real Windows symlink/junction fixtures, internal alias/report scope controls, read-time alias replacement, legacy suppression non-bypass, ignore-glob pruning and non-instruction cycles are covered. POSIX FIFO and case-sensitive controls are included for compatible CI hosts.
• Demo retains the original F 56 findings. Self-scan stays A 100 and doctor has zero errors.
• English, Simplified and Traditional guides and limitations updated together.

Explicit limits

This is not an atomic filesystem sandbox: concurrent replacement of parents/targets remains possible, and hard-link identity/mount boundaries are not certified. Other configuration/workflow readers and explicit report destinations are separate interfaces. Ignored sources and directory aliases have no instruction-coverage claim.

No new model run, human annotation, maintainer message, independent accuracy metric, runtime dependency or publication. Frozen research artifacts and published v0.23.0 distributions remain unchanged.