Bound external result file reads

internal/fileops/read_confined.go

@@ -108,3 +108,14 @@ func ReadRegularFileUnderRoot(
 	}
 	return content, nil
 }
+
+// ReadRegularFile reads a bounded regular file without following symbolic links
+// in its parent hierarchy. It is intended for externally produced results;
+// callers own the limit and semantic validation contract.
+func ReadRegularFile(path string, maxBytes int64) ([]byte, error) {
+	clean := filepath.Clean(path)
+	if clean == "." || filepath.Base(clean) == "." {
+		return nil, fmt.Errorf("file path is required")
+	}
+	return ReadRegularFileUnderRoot(filepath.Dir(clean), filepath.Base(clean), maxBytes, nil, nil)
+}