fix(consume): every read path into a bundle is contained, not just okf_fetch

`okf_fetch` resolved a concept through `connectors.safe_resolve` from the day
the server was written. The other three ways into the same bytes did not.
`okf consume` and `okf_ask` reach `consume.build_payload`, `okf_describe`
reaches `mcp_server.card`, and both built the concept path by joining the
index's own name onto the bundle root. `consume._join` refuses a `..` segment
and an absolute target, but it is a STRING rule over the index text, and a
symlink is a fact about the filesystem that reading that text cannot see: the
index could name `lekkasje.md`, that name could be a link to a file outside the
bundle, and the file came back in the answer.

Measured before the fix, on a bundle carrying one honest concept and one
escaping link: 8 of 11 new rows red, the 3 green ones being `okf_fetch` on the
same two links and the known-positive that the clean bundle still answers. So
the suite was not red for an unrelated reason, and the fix is not "refuse every
bundle holding a link".

One place, not three copies: `consume.resolve_in_bundle` makes the check and
`consume.read_path_in_bundle` adds the file's presence. Every reader here goes
through them -- the index walk, the ref, the document prior, the payload, the
card, `okf_fetch`, and the three outside `consume` (`skill`, `quality`,
`project`) that joined the same way.

Two more failure modes in the same check, because they are the same question:

* A NAMED PIPE is not a regular file. `read_text` on one blocks for as long as
  nobody writes to it, which on a server is the whole process; the red row for
  it ran 60 s to a subprocess deadline and now returns in under a second.
* A DEAD INDEX LINK raised `FileNotFoundError`, and the broad handler in
  `handle` wrote `{error}` into the refusal -- the SERVER's absolute path,
  handed to whoever asked, over one index entry naming a file nobody wrote.
  It is `concept_unreadable` now, naming the concept and not the machine.

The returned path is the JOINED one, never the resolved one: `read_concept`
derives a concept id by taking the read path relative to the bundle root, and
once containment holds the two are the same bytes.

2334 passed, 2 skipped (was 2323 + 2). `mypy --strict src/` clean over 25 files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/llm_ingestion_okf/quality.py

@@ -41,7 +41,13 @@ from collections import Counter
 from dataclasses import dataclass
 from pathlib import Path
 
-from .consume import ConsumeError, enumerate_concepts, read_concept, root_bundle_id_of
+from .consume import (
+    ConsumeError,
+    enumerate_concepts,
+    read_concept,
+    read_path_in_bundle,
+    root_bundle_id_of,
+)
 from .corpus import LOG_NAME
 from .profiles import SEGMENTED_OKF_V0_2, BundleProfile
 
@@ -487,7 +493,7 @@ def measure_bundle(
     pairs: set[tuple[str, str]] = set()
     for concept_id in enumerate_concepts(bundle_root, profile=profile):
         concept = read_concept(
-            bundle_root / f"{concept_id}{profile.paths.concept_suffix}",
+            read_path_in_bundle(bundle_root, f"{concept_id}{profile.paths.concept_suffix}"),
             bundle_root=bundle_root,
             root_bundle_id=root_bundle_id,
         )