Function read_flag 

pub fn read_flag(path: &Path) -> bool

Whether the sentinel file at path exists and holds a truthy value. A missing, oversized, or unreadable file reads as false (no signal). Reuses crate::secure_io::read_capped for the size-bounded read.