Add HTTP restricted artifact reader

docs/internal/sources.md

@@ -52,8 +52,12 @@ failures are operational errors.
 
 `internal/artifact` composes inline and file readers. The ordinary composite
 reader used by CLI and the public engine reads file references from the process
-filesystem. The restricted composite reader used by the HTTP adapter combines
-inline reading with a rooted file reader and optional byte limit.
+filesystem. `internal/adapter/http` provides the restricted public artifact
+reader for HTTP containment: it combines inline reading with a rooted file
+reader and optional byte limit. The existing internal restricted composite
+reader remains a temporary bridge for the current handler and serve wiring; it
+does not define the HTTP reader's long-term boundary or carry a compatibility
+promise.
 
 The rooted reader cleans paths and applies lexical containment without resolving
 symlinks. It checks relative references against the configured root and accepts
@@ -80,6 +84,7 @@ Inspect:
 - `internal/profile/repository_test.go`
 - `internal/profile/builtin/repository_test.go`
 - `internal/artifact/reader_test.go`
+- `internal/adapter/http/artifact_reader_test.go`
 - `internal/validate/standard_validator_test.go`
 - `internal/usecase/integration_test.go`
 - `engine_test.go`