fix(fs): reject backend symlink reads

[chaliy]

Motivation

• Prevent host-backed FsBackend from following symlinks and leaking host files when wrapped by PosixFs (TM-ESC/TM-FS class issue).
• Preserve the documented Bashkit invariant that symlinks are stored but not followed for reads.

Description

• PosixFs::read_file now rejects entries whose stat() reports symlink and returns NotFound instead of delegating to FsBackend::read, preventing a symlink-following backend from escaping the VFS.
• Added a regression test test_posix_read_does_not_delegate_symlink_to_backend that creates a symlink via the backend and asserts read_file fails and the raw backend's read is never invoked.
• Updated threat-model docs to note the mitigation for host-backed filesystems (knowledge/security/threat-model.md and crates/bashkit/docs/threat-model.md).
• Small test-only helper backend added to exercise the behavior in crates/bashkit/src/fs/posix.rs tests.

Testing

• Ran cargo test -p bashkit fs::posix::tests::test_posix_read_does_not_delegate_symlink_to_backend -- --exact and it passed.
• Ran cargo test -p bashkit fs::posix::tests and the suite passed.
• Ran cargo clippy -p bashkit --lib -- -D warnings, cargo fmt --check, and just check-okf; all completed successfully.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	e965586	Commit Preview URL	Aug 07 2026, 04:59 AM