[LIghtJUNction]

Problem

content_fingerprint records leaf symlinks without following them, but a tracked directory replaced by a symlink is still traversed when reading its tracked children. This can fingerprint files outside the checkout as verified source, contradicting the verifier's no-follow contract.

Change

• Check parent components from the checkout outward before inspecting or reading a source entry.
• Reject symlinked parents while preserving existing leaf-symlink recording and clean gitlink handling.
• Add shallow/nested regressions that fail if file content is read, plus a real Git checkout regression for a tracked directory replaced by a symlink.

This is a static checkout guard, not a claim of race-proof traversal under concurrent hostile filesystem changes. No production access, credentials, deployment, or security settings changed.

Verification

• Before fix: 2 new focused regression cases failed by observing external-file read attempts; 17 existing cases passed.
• After fix: 49 standalone local-verification and CI-shard tests passed using Python 3.12, pytest --noconftest -c /dev/null tests/test_local_verification.py tests/test_ci_shards.py -q.
• Ruff 0.16.9 check and format-check on both changed files passed.
• Warnings-as-errors compilation of both changed files and git diff --check passed.
• Full application tests were not run: this environment is Python 3.12, while MSG requires 3.15; repository conftest imports 3.15-only syntax. The standalone tooling tests do not need application fixtures.
• Repository-wide Ruff/format remain blocked only by the existing deploy/check_home_seo.py issues already fixed independently in fix(ci): stabilize Python 3.15 quality and recovery checks #247. This PR deliberately does not duplicate that change.

Base: a97c9c40f08bb19846166fc057a2ae0dff2a81e6. Full CI is pending; keep draft.

[LIghtJUNction]

本 PR 正文中的“Full CI is pending”已有结果：head 9946bc819ceff2ffdddabf5edbe7bc5ad76887d3 的 9 个 workflow run 均已结束，8 个 success，仅 Python quality failure。

已核对 quality artifact 的 source manifest（PR 合成提交 51cd4fcb4ec1b3bbbe319e308fe380b262e655b2）和 Ruff JSON：三条错误全在本 PR 未修改的 deploy/check_home_seo.py，分别是 I001、B007、B904。contracts、recovery 和 issue recovery 已通过。

这项基线修复由 #247 跟踪，不应在这里重复实现。下一步是处理该依赖后更新分支，核验新的组合提交；保留 draft。本次只复核既有 CI 产物，没有重跑或改代码。