Reject symbolic-link draft input files

[conorbronsdon]

Closes the regular-file contract gap in the shared bounded input reader.

Draft create and draft plan/apply now reject a symbolic-link input before opening it. The reader also compares the opened file’s device and inode with the entry inspected first, so a replacement during the check/open window cannot redirect the command to a different file.

The new CLI negative control verifies a linked Markdown file returns invalid_input_file before credential resolution or any network request. This does not change draft-only or immediate-Note semantics.

Validation:

• git diff --check
• npm run lint
• npm test — 1,003 tests passed
• npm run build
• npm run check:release
• npm run test:release — 52 controls passed

[conorbronsdon]

Supplemental Codex/Luna review at ffdbb26 found no high-confidence actionable defect. Reviewed lstat/open/fstat identity checks, nonblocking FIFO handling, symlink rejection, and regular-file happy path; local operator/full-suite and lint checks passed. Existing eight CI jobs passed. This remains supplemental same-family review; independent Claude/OpenCode review is pending.