feat(explore): read_bundle costs O(documents), never O(bytes of the base)

[skip-docs]

S2c / MAJOR-3, order 20260902T151931Z-250257273. The measurement landed first
in ce7f687; this commit is the one seam it authorised, plus the after-table.

read_bundle returned okf.bundle_context -- the WHOLE navigated base. Because
the exploration's participants share one conversation history, that single
function_result rode in FIVE later prompts at full price without anyone asking
for it again: 54-59 percent of every prompt-token in a CLI --explore run.

It now returns the catalogue form one rung down the ladder -- one entry per
concept document (name, type, title, chars) -- with read_file as the next rung.
Tunnel base: 12 595 -> 259 o200k tokens, exploration prompt-tokens -91 percent.

The listing is built from Bundle.context_files and never from files: that is
the property which drops the type: verdict layer at every level, and a listing
built from files would route prior verdicts in front of the navigator around
the gated ExpeL fold while every cost arm stayed green.

A premise was felled before anything was built on it: the tunnel base's root
index body is 4 763 chars alone, nearly the whole ceiling, for a field the
catalogue already excerpts and read_file still returns whole. So read_bundle
carries the listing and not the index.

The tool description and the navigator's instruction both claimed "read its
navigated context" and were updated in the same move -- a description that lies
about the body IS the model's instruction. Two pre-existing asserts would have
gone vacuously true against a list and were strengthened rather than left.

Ceiling lives in the test, not in explore.py. Deviation stated there and in the
docs: it bounds CHARACTERS, not tokens, because tiktoken is not a project
dependency and a gate that skips when an optional package is missing is a gate
that can be silently absent; the conversion was measured (2.89 chars/token) and
the order's own token criterion verified once by the instrument.

Load-bearing measured: seven mutations, all red against the WHOLE suite; green
control 1195 passed / 5 skipped (from 1189/5, strict superset); golden
demo-transcript.stdout byte-unchanged; and the debate's three bundle_context
copies are byte-identical before and after, which proves run.py and the
nav-goldens were not touched rather than asserting it.

tests/test_explore_loadbearing.py

@@ -683,7 +683,9 @@ async def test_an_exploration_leaves_the_knowledge_base_byte_identical(tmp_path:
     # Every read tool, called on the same base, with model-shaped arguments.
     tools = {t.name: t for t in explore.navigator_tools((str(base),))}
     assert tools["list_bundles"].func()[0]["id"] == base.name
-    assert tools["read_bundle"].func(bundle_id=base.name) != ""
+    # A LISTING since S2c, so ``!= ""`` would be vacuously true for any list at all — assert the
+    # shape the tool now promises instead of the shape it used to.
+    assert [e["name"] for e in tools["read_bundle"].func(bundle_id=base.name)]
     assert tools["read_file"].func(bundle_id=base.name, path="index.md") != ""
     explore.quick_validate_tool((str(base),)).func(
         bundle_id=base.name, proposal_json=json.dumps(_micro_projection())