feat(okf): scan reserved index.md/log.md in mode-b import, not path-reject (review MAJOR #2)

A received OKF bundle MAY legitimately carry index.md (directory listing, read
first under progressive disclosure) and log.md (update history) at any level
(spec §3.1/§6/§7). import_bundle previously hard-rejected those basenames in the
T4 path gate, so a conformant third-party bundle was over-blocked in full
(FAIL_SECURE) — and because the reject fired before scan_concept, index.md's
body (the highest-priority injection surface) was never scanned.

import_bundle now defaults allow_reserved=True: reserved basenames are scanned
as structural files (path-safety checks — traversal / absolute / backslash / .md
— still apply). The shadow-reject (an *upload* masquerading as index.md) is
preserved: the front-end passes allow_reserved=False so a materialized upload
landing on a reserved basename is still refused. That front-end opt-in was
required to keep the shadow-reject once the default flipped (not in the plan's
Filer set; traced from the code).

- okf.py: validate_concept_path/_validate_concept/import_bundle gain the
  keyword; validate_concept_path default stays False (strict standalone).
- tests: +3 (legit index/log admit; injection in index.md body caught;
  okf_version frontmatter admits). Per-concept-iteration test switched to a
  traversal vector; mode-b showcase's index.md surface reframed from
  reserved-name-reject to index.md-body-scan.
- README honest-limits + CLAUDE.md context note the mode-b/upload distinction.

Suite: 341 -> 344 passed. Core invariant intact (dependencies=[]).

README.md

@@ -116,6 +116,12 @@ that a green scan means safe content:
   the payload is planted later, when that target is written. A scanner that sees
   one document at a time cannot catch it; it needs cross-write graph re-scan
   (tracked for the OKF adapter).
+- **OKF reserved files (`index.md` / `log.md`).** In a *received* bundle these are
+  legitimate structure (directory listing, update log), so mode-b `import_bundle`
+  scans their body and frontmatter — an injection planted in a directory listing
+  is caught — rather than path-rejecting the whole conformant bundle. The upload
+  front-end keeps the opposite rule: an individual upload landing on a reserved
+  basename is a shadow of the listing and is refused (`allow_reserved=False`).
 - **A document that *describes* attacks is a false positive.** Content whose
   legitimate purpose is to document prompt-injection payloads (security notes,
   this project's own corpus) trips carrier-strip / fail-secure. At the text layer