ingest: config readers may follow a PR symlink out of the source root #732

Raised in the #731 re-review and not confirmed.

cgis ingest skips source files that resolve outside the root (pipeline/__init__.py:319). The project readers may still follow a symlink out of the root:

• tsconfig and package.json under languages/typescript/*;
• go.mod in languages/go/project.py.

Risk is low. In guardian.yml the ingest step holds no secrets, and the target has to parse as JSON or go.mod. The class is the same, though: data the PR controls reads somewhere else.

Done when: each project reader either uses the same containment (resolve().is_relative_to(root)) or is shown not to follow links, and a test links a config file outside the root.

🤖 Generated with Claude Code