fix(source): reject symlinks when listing dashboard files

[SebTardif]

What Problem This Solves

The dashboard renderer lists review markdown and run JSON with readdirSync plus readFileSync. Those APIs follow symlinks. The action ledger walker already rejects any symlink under the source root. A *.md or *.json symlink on the state tree can pull bytes from outside that tree into the published README.

Evidence

Live node import of markdownFiles and readText on the patched tree. A file symlink named 1.md pointing at a file outside the listing directory throws. A regular markdown file still lists.

$ node --input-type=module -e "import { markdownFiles, readText } from './scripts/source.mjs'; ..."
LIST_THROW [clawsweeper-state] source contains symlink: C:\Users\sebta\AppData\Local\Temp\proof-md-hPKH6S\1.md
READ_THROW [clawsweeper-state] source contains symlink: C:\Users\sebta\AppData\Local\Temp\proof-md-hPKH6S\1.md
REGULAR [ 'C:\\Users\\sebta\\AppData\\Local\\Temp\\proof-ok-mTihT9\\2.md' ]

Real behavior proof

• Behavior or issue addressed: Dashboard source listing and reads fail closed on symbolic links, matching the ledger walker, instead of following them into README.md.
• Real environment tested: Windows 11, Node v24.19.0, patched scripts/source.mjs on branch fix/source-reject-symlinks.
• Exact steps or command run after this patch: Created a temp directory with 1.md as a file symlink to secret.md outside that directory. Imported markdownFiles and readText from ./scripts/source.mjs with node --input-type=module. Then listed a directory that contains only a regular 2.md.
• Evidence after fix: terminal output from that node command (see Evidence). Both list and read print source contains symlink. The regular file path is returned as a one-element array.
• Observed result after fix: readdirSync({ withFileTypes: true }) plus lstatSync reject the symlink before readFileSync can follow it.
• What was not tested: A symlink committed on the live state branch inside GitHub Actions.

Change

scripts/source.mjs lists only regular files and throws on symbolic links for markdownFiles, jsonFiles, readText, and readJson.

Origin

Introduced in 7964f2af5f7.