feat(import): Door C flow against an injected import gate (Phase 2 step 5)

Reads an external OKF bundle as {bundle-relative path -> document text},
hands it WHOLE to an injected gate over the guard's okf.import_bundle (a
bundle-level call: it resolves the cross-link graph across concepts), and
merges only concepts clearing the non-blocking floor. Same injection pattern
as Door B, so the core stays dependency-free while the CI channel for the
real guard is settled.

Two constraints shaped the design and are pinned by tests:

- A merged concept is written VERBATIM. Stamping provenance into it would
  require round-tripping its frontmatter through this library's line-oriented
  parser, which cannot represent the block lists the guard's parser accepts --
  silent data loss -- and would persist bytes the guard never screened.
- Ownership is therefore proven by content identity: identical bytes at the
  target name are a no-op re-merge (re-import of an unchanged bundle is
  idempotent), and anything else at the name is refused. Curated content and
  an updated concept are refused alike; refusing is what never destroys.

The floor is fail-closed beyond the plan's "no error" wording: an error, an
unrecognised disposition, and a concept the gate returned no verdict for are
all refusals. quarantine_review stays its own bucket, as at Door B.
origin/channel are validated against the guard's pinned vocabulary -- it
derives trust from origin by enum identity, so an unrecognised string would be
silently downgraded rather than caught.

Three primitives promoted for reuse rather than duplicated:
reduce_to_id_grammar and check_filename_length to materialize.py, and
extract.decode_text. Door C slugs the WHOLE concept path, so tables/users.md
and views/users.md stay distinct. Concept discovery folds case explicitly
rather than globbing *.md, whose case-sensitivity follows the filesystem and
would import the same bundle differently on APFS and ext4.

README's "what is gated today" section corrected: it claimed nothing is gated,
which is no longer true, but the honest statement is narrower than "the doors
are gated" -- the library cannot verify that an injected adapter is a real
guard, and a permissive stub is believed.

405 tests green; ruff, ruff format and mypy --strict clean.

src/llm_ingestion_okf/extract.py

@@ -33,7 +33,7 @@ _OPTIONAL_EXTENSIONS = frozenset({".pdf", ".docx", ".xlsx"})
 _SKIP_TAGS = frozenset({"script", "style"})
 
 
-def _decode(data: bytes) -> str:
+def decode_text(data: bytes) -> str:
     """Decode file bytes as UTF-8 (BOM-stripping), typed on failure.
 
     utf-8-sig so a byte-order mark never leaks into the first character
@@ -50,12 +50,12 @@ def _decode(data: bytes) -> str:
 
 def _extract_passthrough(data: bytes) -> str:
     """`md`/`txt`: the decoded text verbatim."""
-    return _decode(data)
+    return decode_text(data)
 
 
 def _extract_csv(data: bytes) -> str:
     """`csv`: parse with the stdlib reader, render the Phase 1 markdown table."""
-    reader = csv.reader(io.StringIO(_decode(data)))
+    reader = csv.reader(io.StringIO(decode_text(data)))
     header = next(reader, None)
     if header is None:
         raise ExtractionError("CSV has no header row", code="extractor_empty_csv")
@@ -65,7 +65,7 @@ def _extract_csv(data: bytes) -> str:
 
 def _extract_json(data: bytes) -> str:
     """`json`: the decoded text verbatim inside a fenced block (Phase 1 renderer)."""
-    return render_fenced_block(_decode(data))
+    return render_fenced_block(decode_text(data))
 
 
 class _HTMLTextExtractor(HTMLParser):
@@ -105,7 +105,7 @@ class _HTMLTextExtractor(HTMLParser):
 def _extract_html(data: bytes) -> str:
     """`html`/`htm`: text via `html.parser`, script/style stripped (spec B3)."""
     parser = _HTMLTextExtractor()
-    parser.feed(_decode(data))
+    parser.feed(decode_text(data))
     parser.close()
     return parser.text()