Harden explicit path references and fail closed on index errors

[LE0-Lin]

Summary

Fix two reproducible path-resolution failures and a partial-index failure mode:

• Explicit ./ and ../ prose references can no longer pass because an unrelated package contains the same suffix. Keep existing root/AGENTS-scope interpretations; other instruction formats also accept an explicit document-relative path. This does not infer command working directories or change document-relative Markdown links.
• Preserve significant dots in hidden directory names such as .github; do not substitute an indexed path when every concrete interpretation escapes the repository.
• Propagate directory traversal errors instead of silently returning a partial index. Scan/compare/feedback fail with operational exit 2 and no success report. Doctor adds the repository-paths check. Traversal diagnostics are fixed messages rather than raw filesystem details; excluded dependency/admin trees remain pruned.

No new scoring rule, penalty, runtime dependency, maintainer message, model run or publication.

Verification

• Reproduced the suffix/dot/index-error failures before changing the scanner.
• Full suite: 303 tests completed, 1 environment-specific skip; all remaining tests passed.
• Demo keeps the original F 56 findings, including contradiction, dangerous command and missing path.
• Self-scan stays A 100; doctor has zero errors and a passing path-index check.
• English, Simplified and Traditional guides/limits reviewed together, including compatibility and filesystem-check boundaries.

The retained Next.js development report remains unchanged and explicitly dated to its original tool fingerprint. These synthetic regressions and operational checks are not independent accuracy measurements or real user feedback. Published v0.23.0 artifacts remain unchanged.