### reproduction attempt
# setup: Created a temporary vault, an outside Markdown file containing PRIVATE_MARKER, and vault/linked.md pointing to that outside file.
$ swift run banal show linked.md --vault <vault>

### observed runtime output
# attempt 1: exit code 1; stdout was empty; compilation failed before CLI execution.
error: no such module 'UniformTypeIdentifiers'

# attempt 2: repeated the symlink fixture with a cached build.
$ swift run --skip-build banal show linked.md --vault <vault>
# result: exit code 1; no application behavior was reached because the cached executable did not exist.
error: exec error: No such file or directory: .build/.../debug/banal

### source readback
# Sources/BANALCLI/BanalCLI.swift:302-317 validates the extension, rejects lexical absolute paths, standardizes the candidate, and checks a lexical path prefix.
let root = configuration.rootURL.standardizedFileURL.path
let candidate = configuration.rootURL.appendingPathComponent(id).standardizedFileURL
guard candidate.path.hasPrefix(root + "/") else {
    throw CLIFailure("note id must stay inside the vault")
}
guard FileManager.default.fileExists(atPath: candidate.path) else {
    throw CLIFailure("no note \"\(id)\" in \(root)")
}
return candidate

# The guard does not resolve symlinks for either root or candidate. A vault-local linked.md can therefore pass the lexical check while Foundation follows the link to an outside file when the returned URL is read.
# environment: The local workbench reports that the native app requires macOS 14+ with Xcode 16+; Linux compilation was unavailable.
# final result: REV-2 failed - source confirms a symlink containment bypass, while direct runtime reproduction was blocked before CLI execution.