validate: 'link target escapes bundle root' can't be silenced without losing missing-link detection

[davidmoshal]

Summary

openknowledge validate <bundle> emits a link-target warning — link target escapes bundle root: <href> — for every local Markdown link whose target resolves outside the bundle root.

For an integrated knowledge base (a Wiki/ inside a repository, as okn setup creates), links from wiki concepts to the source files they document are normal and deliberate. Every one of them triggers this warning on every validate run.

The escape warning and the "does not exist" warning share a single rule ID, link-target, so link-target = "off" silences both — there is no way to keep missing-link detection while suppressing the escape noise.

Reproduction

mkdir -p repo/src repo/Wiki
printf 'package demo\n' > repo/src/app.go
printf '# Index\n\n[App](../src/app.go)\n' > repo/Wiki/index.md
openknowledge validate repo/Wiki

Output (current main):

Issues
  warning index.md:3: link target escapes bundle root: ../src/app.go

Why this is a problem

1. The spec does not restrict links to the bundle. OKF 0.1 section 5.2 defines relative links as "standard markdown relative paths" with no in-bundle requirement. Section 5.3 says a link whose target does not exist in the bundle is not malformed. Section 9 lists "Broken cross-links" among the things consumers MUST NOT reject a bundle over.
2. Agent flows churn on it. The built-in flow templates instruct agents to "Run openknowledge validate Wiki and fix validation errors or avoidable warnings", and openknowledge validate Wiki is the default verify command. The only way to clear these warnings is to delete legitimate source links, so maintenance agents either report them forever or degrade the wiki.
3. It cannot be silenced without losing real coverage. Both "escapes bundle root" and "does not exist" share the single link-target rule ID, so link-target = "off" also disables broken-link detection for in-bundle links.

Proposal

Split the escape warning into its own link-escape rule, keeping link-target for in-bundle missing targets only. The unconfigured default stays unchanged (the escape warning still appears by default), and bundles can then silence escape warnings alone via link-escape = "off" in .openknowledge.toml or --rule link-escape=off without losing missing-link detection.

Migration note: existing link-target = "off"|"error" configs will need a matching link-escape entry, since link-target would then govern only missing-target; and JSON consumers keying on rule: "link-target" for escape issues would need to update to link-escape.

PR: #25