Consolidate lint entry-file reads through NativeFs (single source of truth)

[dean0x]

Location: crates/mds-core/src/lib.rs:1009 (+ crates/mds-cli/src/lint.rs:756, 843)

The entry file is read 2–3× per lint invocation. The lint re-parse read uses a raw std::fs::read (crates/mds-core/src/lib.rs:1009) that:

• bypasses the NativeFs abstraction used everywhere else,
• re-implements the size guard inline instead of reusing the shared guard, and
• skips the symlink recheck that NativeFs performs.

This is a latent source-of-truth split between the diagnostic-keyed copy of the source and the --fix/span-render copy. It reads bytes independently on separate code paths, so the two copies can diverge under a concurrent mutation.

Nothing ships broken today: the --fix reverify byte-equality gate (ADR-001) fail-closes on a stale-read mismatch, and the symlink case is covered by the NativeFs check-gate on the first read. This is a robustness/DRY concern, not a live bug.

Deferred From: PR #171 (Closes #61) — mds lint release gate — cycle-2 review (I-07)
Review: .devflow/docs/reviews/feat-mds-lint-61/2026-07-12_0020/resolution-summary.md

Reason for Deferral:
Reworks the shared resolve/lint entry-read API, which is shared with build/check. lint_str_with currently hardcodes the "input.mds" file key, which blocks straightforward CLI reuse. This exceeds the final-polish blast radius of the lint release gate.

Acceptance Criteria:

• Entry source is read once per lint invocation and threaded through the resolve step (or a source-accepting public entry is added) so diagnostic-keyed and --fix/span-render copies share one buffer
• The lint re-parse read goes through NativeFs (no raw std::fs::read), reusing the shared size guard and symlink recheck rather than re-implementing them
• lint_str_with no longer hardcodes the "input.mds" file key — the caller supplies the display path, unblocking CLI reuse
• Behavior preserved on both JSON and human output paths; all Rust tests + cli_lint.rs suite pass