Summary:

• Reports symlinked supported instruction file paths as AIRK-SYS002 instead of following them.
• Avoids traversing symlinked wildcard instruction directories.
• Hardens init write temporary and backup paths against symlink escapes.

Verification:

• Direct symlink reproduction reports AIRK-SYS002.
• Parent symlink reproduction reports AIRK-SYS002.
• Wildcard symlink directory reproduction is not traversed.
• Targeted unittest suite passed.
• Full local check passed: 118 tests, Ruff, text hygiene, git whitespace.
• Secret-like pattern scan passed.

Scope:

• CHANGELOG.md
• README.md
• docs/RULES.md
• discovery/governance/init filesystem boundary code
• path boundary tests