fix(terminology): consume the exact cache bytes that were verified

[TheHalfMoon]

Finding

A repository-wide hardening audit found a TOCTOU gap in crates/commandf-pkg/src/terminology_index.rs on canonical main 8a45857bf31c4acae57fdfb1e3cdde3d0f7d0361.

Current TerminologyClosure::load does:

1. lockfile.verify_cache(cache)?;
2. later reconstructs each cache path;
3. later calls fs::read(path) and consumes those newly-read bytes.

That separates digest verification from the bytes actually parsed/inspected. A concurrent or malicious local mutation between the verification read and the later fs::read could cause terminology analysis to consume bytes that were never digest-verified.

This is narrower than a generic cache-corruption check: the current code correctly verifies the cache at one point in time, but does not bind verification to the exact bytes subsequently consumed.

Expected repair

Refactor terminology closure loading to consume the bytes returned by the cache's verified read boundary, e.g. PackageCache::read_verified / an appropriate bounded verified read, rather than verify-all then raw-read by path.

Do not weaken existing manifest identity, package identity, duplicate filename, terminology canonical, or fail-closed behavior.

Required regression

Add a deterministic regression that proves terminology loading does not use a second unverified filesystem read. Prefer an injected/read-boundary test or another deterministic construction over a timing-dependent race test.

Also inspect whether any other production source path performs verify-then-independent-read against cache objects. Initial code search found this explicit pattern in terminology_index.rs; do not assume exclusivity without checking current main.

Governance

• Keep this repair separate from AF-01 planning PR docs(assurance): plan trusted development baseline #34.
• No CF-06 production oracle identity change.
• No CF-10 corpus change.
• No terminology semantic redesign.
• Exact-head mandatory CI + path-applicable proof workflows + CodeRabbit/Qodo review before merge.

Severity rationale

Security/integrity hardening: local verified-cache trust boundary can be raced/rebound. There is no claim of remote exploitability in the current product boundary, but commandF's evidence model requires the consumed bytes to be the bytes whose digest was verified.