fix(core): bound untrusted file reads and refuse irregular files

[blackaxgit]

• Add clx_core::bounded_read: opens then fstats the handle (closing the stat-vs-open TOCTOU window), sets O_NONBLOCK on Unix so a writerless FIFO cannot hang the open itself, rejects non-regular files, caps by size, and still reads via take(cap) against post-fstat growth.
• Apply at all three untrusted-path reads: credentials.age (16 MiB), project/global instructions files (4 MiB), config-trust target (4 MiB).
• credentials.age treats non-regular and oversized as hard errors rather than an empty store, so a later set/delete can never re-encrypt an empty map over whatever is actually at that path.