Harden API key file loading

docs/internal/fileops.md

@@ -31,6 +31,14 @@ tree through those directory handles. It rejects root deletion and any symlink
 encountered in the target path or tree; repeated removal of a missing target is
 successful. Command and post-publish policy remains owned by `internal/app`.
 
+## Confined Reads
+
+`ReadRegularFileUnderRoot` is the no-follow, bounded read primitive for a
+caller-selected root and relative file path. It verifies the root and every
+ancestor through directory handles, admits only a stable regular-file handle,
+and lets the caller enforce its own byte limit and access policy. Credential
+mode policy and environment precedence remain owned by `internal/app`.
+
 ## Replacement Contract
 
 `ReplaceFileAtomic` requires an existing destination directory. It creates a