feat(indexer): enforce runtime source-boundary protections

[alucero270]

Summary

• harden markdown scanning so ingestion only reads entries proven to remain inside the configured source boundary
• skip symlink and reparse-point entries instead of following them during ingestion
• document the implemented runtime boundary behavior and how operators can verify it locally

Validation

• dotnet build src/Codex.Indexer/Codex.Indexer.csproj '-p:OutDir=C:/Users/Alex Lucero/source/repos/strata/artifacts/validation/indexer/out/'
• git diff --check

Notes

• this keeps the current single configured source-root model and does not introduce source persistence or source-scoped APIs
• automated boundary coverage remains a separate follow-up issue

Closes #44