fix(kb-lint): a wikilink must not resolve into the quarantine

The resolver copied Obsidian's filename-anywhere semantics with a raw rglob, which
walked .AGENTTRASH/ as well. [[log]] therefore stayed "valid" by landing on the
quarantined core/log.md — a page that is out of circulation until a pruning session
and, being gitignored, does not exist on any other machine. The gate reported a
green bundle while pointing readers at a file git does not carry: exactly the #57
failure, hidden by the check that exists to catch it.

Resolution now uses the same filtered set linting uses (pages()), so the two can
never disagree about what exists. A companion test pins that filename-anywhere
resolution for live pages still works, so the narrowing costs nothing; mutating
the resolver back to rglob turns the new test red.

Refs #60

tests/kb-lint.bats

@@ -120,6 +120,28 @@ EOF
   [[ "$output" == *"0 violation(s)"* ]]
 }
 
+@test "a wikilink must not resolve into the quarantine" {
+  # Obsidian resolves [[name]] by filename anywhere under the vault, and the resolver copied
+  # that with a raw rglob — so [[log]] stayed "valid" by landing on the copy waiting in
+  # .AGENTTRASH/. That is #57's failure wearing a green check: the page is out of circulation
+  # until a pruning session with Frank, and it is not even tracked, so on another machine the
+  # link points at nothing while the gate here says it is fine.
+  mkdir -p "$KB/.AGENTTRASH"
+  printf 'no frontmatter, quarantined\n' > "$KB/.AGENTTRASH/log.md"
+  printf -- '---\ntype: reference\n---\nSee [[log]] for the history.\n' > "$KB/good.md"
+  run bash "$LINT" "$KB"
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"broken wikilink -> [[log]]"* ]]
+}
+
+@test "a wikilink to a live page still resolves, in any directory" {
+  # The narrowing above must cost nothing: filename-anywhere semantics is the point.
+  printf -- '---\ntype: reference\n---\nSee [[good]].\n' > "$KB/sub/other.md"
+  run bash "$LINT" "$KB"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"0 violation(s)"* ]]
+}
+
 @test "the shipped knowledge base itself is conformant" {
   # The tests above exercise the linter against fixtures; nothing else in the
   # suite ever points it at the real bundle, so a page added without frontmatter