fix: reject legacy root /skills/ and root-level /sources/ in FS contract

[mishanefedov]

Summary

• Reject `/wiki/` and `/skills/` as legacy roots (BrainContractError instead of pass-through)
• Remove root-level `/sources/` from read-only roots; only `/private/sources/` is valid
• Update module docstring to reflect rejection semantics
• Remove `/workspace/teams//` idiom from README

Test plan

• `pytest` passes with updated assertions for legacy-root rejection
• `/workspace/teams/eng/docs/arch.md` test unchanged (still valid under /workspace/)

---

Summary by cubic

Reject legacy roots /wiki/ and /skills/, and block root-level /sources/, in the filesystem contract. This prevents bad paths from passing through and aligns the client with server rules.

• Bug Fixes
  • Raise BrainContractError for paths under /wiki/ and /skills/.
  • Disallow /sources/...; only /private/sources/... is valid. Keep /system/ as the only read-only root.
  • Update README (remove workspace/teams/<slug>/ mention) and tests to match the new rules.

^{Written for commit 6f4ebe0. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}