The recursive markdown walker in `src/commands/import.ts` used
statSync, which follows symlinks. Combined with the `.md` extension
filter, that lets a contributor to a shared brain plant a symlink
at `notes/innocent.md` pointing at `~/.gbrain/config.json`,
`~/.aws/credentials`, `/etc/passwd`, `~/.zshrc`, `.env`, or any
other file the importing user can read. On the next `gbrain import`,
the walker treats the symlink as a regular file, `readFileSync`
follows the link to its target, and the secret ends up chunked,
embedded via OpenAI, and indexed in Postgres — at which point a
bearer-token holder can exfiltrate it via `search` / `get_page`.

Circular symlinks are a separate variant of the same bug: walking
into a symlinked directory that ultimately points back into the
brain root causes unbounded recursion and an OOM crash during
import.

PR garrytan#26 / garrytan#38 already added `node_modules` skipping and a try/catch
around `statSync` so broken symlinks wouldn't crash the walker, but
left the symlink-following behavior intact — a valid symlink was
still silently read.

Fix:

- Replace `statSync` with `lstatSync`. `lstatSync` describes the
  link itself, not the target, so we can identify symlinks before
  we commit to following them.
- Add an explicit `stat.isSymbolicLink()` branch that logs a skip
  warning and continues. No realpath containment, no depth cap, no
  visited-set — skipping all symlinks entirely is the simplest
  defense and is strictly stronger than any of those alternatives.
  Hard links are out of scope (a hard link is indistinguishable
  from the original file; any fix would break legitimate use).
- Export `collectMarkdownFiles` so it can be unit-tested in
  isolation instead of being reachable only through `runImport`.

Tests added in `test/import-walker.test.ts`:

- `includes real markdown files inside the root` — baseline: a
  normal brain dir with a top-level and a nested .md file produces
  both paths.
- `skips a symlink file pointing outside the brain root` — the
  core security test. Plants a symlink at `innocent.md` pointing
  at a secret in a sibling tmpdir, asserts the walker output
  contains neither the symlink nor the canonical secret path.
- `does not descend into a symlinked directory` — ensures the
  fix also blocks the directory-symlink variant, which is what
  lets circular symlinks become a DoS primitive.
- `skips broken symlinks without crashing` — pins the invariant
  that PR garrytan#26 / garrytan#38 already established (dangling symlinks don't
  throw), so that regression can't reappear. `lstatSync` actually
  succeeds on a dangling link since it stats the link inode, so
  we reach the `isSymbolicLink()` branch and skip cleanly.

Refs: report/evidence/poc-l002-symlink-import.ts