docs(system-overview): scope symlink-escape claim to upload; clone gap tracked in #182

[parthrohit22]

Summary

SYSTEM_OVERVIEW.md incorrectly stated that symlink-escape rejection applies to the GitHub clone path. Only upload extraction guards symlinks (storage/local.py:121); the clone tree walk follows symlinks (verified, issue #182 — filesystem disclosure + recursion/DoS). This corrects the documentation to match the code and avoids overstating a security control.

Linked issue

Related to #182

What changed

• docs/architecture/SYSTEM_OVERVIEW.md: import diagram note, validation node, and untrusted-input bullet now scope symlink rejection to upload and reference security: clone path does not guard symlink escapes (filesystem disclosure + DoS) #182 for the clone-path gap.

Acceptance criteria completed

• Symlink-escape claim scoped to upload only
• Clone-path gap referenced via security: clone path does not guard symlink escapes (filesystem disclosure + DoS) #182
• No other documentation changed

Testing performed

Documentation-only change; no code/test impact. Verified the three edited passages read consistently with storage/local.py:121 (upload guard) and repository_parser.py (clone walk follows symlinks).

Screenshots

Not applicable

Security and data considerations

Documentation honesty fix: removes a false claim that the clone path rejects symlink escapes. No code, secrets, or data changed.

Dependencies and blocked work

Depends on #182 for the actual clone-path hardening (this PR only documents the current state).

Scope changes or remaining work

None — documentation only.

Contributor checklist

• Targets dev
• Branch from up-to-date upstream/dev
• One scoped issue (doc accuracy)
• Tests not required (docs only)
• No secrets/artifacts committed
• Closing syntax used only because issue fully resolved — N/A (Related to security: clone path does not guard symlink escapes (filesystem disclosure + DoS) #182, not closing)