fix: rules-loader guarded read + private session-state dir (iss-66)

[REPPL]

Resolves iss-66 (native ledger) — rules-loader trust-boundary hardening from the clean-slate sweep.

Fixes (internal/core/rules)

All three file readers now share one guarded reader, readGuarded, which opens once with O_NOFOLLOW+O_NONBLOCK, validates the same fd (regular file, size cap) and reads through a LimitReader:

• C19 — symlink-swap TOCTOU. Load did Lstat(path) then os.ReadFile(path), re-resolving by name; a swap to a symlink in that window followed the link. Now closed by the open-once read.
• F1 — FIFO hang (a regression the first cut introduced, caught in review). O_NOFOLLOW alone doesn't stop a FIFO/device leaf, and open(fifo, O_RDONLY) blocks forever — which would wedge the UserPromptSubmit prompt-router hook whose contract is "never block a session." O_NONBLOCK makes a FIFO open return immediately so the regular-file check rejects it. (O_NONBLOCK is a no-op for reads on regular files.)
• P14 — shared-temp state. The prompt-router's per-session dedup state moved from the world-writable shared temp dir (predictable sha256(session) path, session defaulting to the constant "default") to the per-user cache dir, so a local co-tenant can't pre-create the path to suppress injection. ABCD_RULES_STATE_DIR still overrides.
• Consolidation. LoadState and LoadBackstop carried the same Lstat→ReadFile TOCTOU; they now route through readGuarded too (fail-open preserved). A post-read length check complements the fstat size cap.

Tests (each watched fail on revert)

• TestLoadRefusesSymlinkedRulesFile — a symlinked rules.json leaf errors (the old test only covered a symlinked .abcd dir).
• TestLoadRefusesFifoRulesFile — a FIFO leaf is refused within 3s, not hung on.
• TestStateDirNotSharedTemp — default state lives under the user cache dir, not shared /tmp (skips on a degraded no-HOME env).

make preflight + make record-lint green; rules package green under -race. Reviewed over two rounds: ruthless SHIP, security PASS — the security reviewer found the F1 FIFO BLOCK on the first cut and re-verified the fix.

Deferred / document-accepted (see DECISIONS.md)

P15 — a per-repo .abcd/rules.json can set a default domain dormant and flip the global kill switch. This is the intended opinionated-but-overridable model: .abcd/rules.json is a committed file (editing it needs repo write access), and the real enforcement of dangerous actions is harness-level (git-guardrails hooks, the identity gate, pre-commit), not the injected advisory prose. Surfaced, not taken: a protected "guardrail" domain class that an override could not disable — a trust-model decision for the maintainer, not an autonomous change.

Assisted-by: Claude:claude-opus-4-8