feat: resolve external notebook payloads with bounded SMB reads

Read documented onefiles payloads through the shared notebook service. Keep empty files distinct from missing data, reject partial reads and failed close, and prevent stale diagnostic exports when only an external payload changes. Move the document exporter beside its directory resolver.

Native OneNote independently reopened generated external references and extracted exact empty, 1 KiB and 20 MiB attachments. Validated local/SMB parity, ten payload interruption cases, all 362 publication-loss cases with independent server hashes, workspace/report tests, Clippy and Apple target linking.

Assisted-by: gpt-6-astra
30d02b72f6clover caruso committed on 9/8/2026, 1:42:27 AMparentbca7120
31 files changedLine totals unavailable