Migrate ordinary I/O from confined file helpers

internal/adapters/audita/subprocess.go

@@ -425,7 +425,7 @@ func validateJSONFile(path string) error {
 }
 
 func readAuditaResult(path string, limit int64, category string) ([]byte, error) {
-	data, err := fileops.ReadRegularFile(path, limit)
+	data, err := fileops.ReadFileBounded(path, limit)
 	if err != nil {
 		return nil, fmt.Errorf("audita %s result exceeds or cannot be read within %d-byte limit: %w", category, limit, err)
 	}

internal/adapters/notarius/subprocess.go

@@ -671,7 +671,7 @@ func sumWarningOccurrences(values []WarningSummary) (int, error) {
 }
 
 func decodeBoundedJSON(path string, limit int64, destination any) error {
-	data, err := fileops.ReadRegularFile(path, limit)
+	data, err := fileops.ReadFileBounded(path, limit)
 	if err != nil {
 		return fmt.Errorf("notarius JSON result exceeds or cannot be read within %d-byte limit: %w", limit, err)
 	}

internal/adapters/scriptorium/subprocess.go

@@ -346,7 +346,7 @@ func writeInvocationConfig(path string, payload invocationPayload) error {
 }
 
 func validateNonEmptyOutput(path string) error {
-	data, err := fileops.ReadRegularFile(path, MaxOutputFileBytes)
+	data, err := fileops.ReadFileBounded(path, MaxOutputFileBytes)
 	if err != nil {
 		return fmt.Errorf("scriptorium artifact output exceeds or cannot be read within %d-byte limit: %w", MaxOutputFileBytes, err)
 	}

internal/adapters/seriatim/subprocess.go

@@ -692,7 +692,7 @@ func validateNonEmptyTextFile(path string) error {
 }
 
 func readSeriatimResult(path, category string) ([]byte, error) {
-	data, err := fileops.ReadRegularFile(path, MaxOutputFileBytes)
+	data, err := fileops.ReadFileBounded(path, MaxOutputFileBytes)
 	if err != nil {
 		return nil, fmt.Errorf("seriatim %s exceeds or cannot be read within %d-byte limit: %w", category, MaxOutputFileBytes, err)
 	}

internal/adapters/subprocess/diagnostics.go

@@ -255,7 +255,7 @@ func openDiagnosticFile(path string) (*os.File, error) {
 	if err := fileops.EnsureWorkspaceDirectory(filepath.Dir(path)); err != nil {
 		return nil, fmt.Errorf("create log directory for %q: %w", path, err)
 	}
-	file, err := fileops.OpenFileConfined(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, fileops.WorkspaceFileMode)
+	file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, fileops.WorkspaceFileMode)
 	if err != nil {
 		return nil, fmt.Errorf("open log file %q: %w", path, err)
 	}

internal/adapters/subprocess/run_test.go

@@ -163,15 +163,15 @@ func TestRunRejectsSymlinkDiagnosticWithoutTruncatingTarget(t *testing.T) {
 		StdoutLogPath: stdoutPath,
 		StderrLogPath: filepath.Join(dir, "stderr.log"),
 	})
-	if err == nil || !strings.Contains(err.Error(), "symbolic link") {
-		t.Fatalf("Run() error = %v, want symbolic-link rejection", err)
+	if err != nil {
+		t.Fatalf("Run() error = %v", err)
 	}
 	data, readErr := os.ReadFile(targetPath)
 	if readErr != nil {
 		t.Fatalf("ReadFile(target) error = %v", readErr)
 	}
-	if string(data) != original {
-		t.Fatalf("target content = %q, want %q", data, original)
+	if string(data) == original {
+		t.Fatal("diagnostic target was not replaced")
 	}
 }