Fix: codemaps to index nested repo worktree sources

[w-winter]

Fixes #886. A workspace root containing nested Git repos could leave background codemap (CM) indexing stuck retrying the same catalog page indefinitely.

The likely regression came from the content-addressed CM source-acquisition path (#314). Nested .git detection correctly prevented the outer repo's blob identity from authorizing those files, but classified them as repo-unavailable instead of using the existing validated-worktree path. The graph treated that stable condition as transient, discarded the completed page, and retried the same cursor.

Instead of excluding nested source this patch restores CM eligibility for every supported file admitted by the workspace catalog. Nested files are built from their current fingerprint-validated worktree bytes and normal ignore policy is unchanged.

Summary

• Continue descriptor-safe traversal beyond nested .git directory and pointer-file markers
• Preserve the requested leaf fingerprint instead of the repo marker fingerprint
• Route regular nested source through the existing validated-worktree CM path
• Prevent outer Git blobs, attributes, status, and path-local metadata from becoming authoritative after a nested boundary
• Preserve existing missing, symlink, nonregular, and probe-failure outcomes
• Complete graph indexing without boundary-driven retries or terminal exclusions

Implementation Notes

• GitBlobIdentityService remains the sole source-provenance classifier
• The graph index, workspace catalog, root topology, ignore handling, and UI are unchanged
• No nested Git commands, repo lifecycle, retry mechanism, compatibility path, or new source-acquisition path was added
• Outer index entries remain available as non-authoritative evidence that the nested boundary takes precedence

Review Approach

• The patch received one focused maintainability review and complete-patch correctness reviews tethered to the originating issue's scope
• Findings around nested-owned Git metadata and retaining boundary state across terminal leaf outcomes were fixed with focused regressions

Validation

Passed locally:

• make dev-test FILTER=GitBlobIdentityServiceTests
• make dev-test FILTER=CodemapAutomaticSelectionGraphNativeTests
• make dev-lint
• make dev-swift-build PRODUCT=RepoPrompt
• PR-ready preflight, including the matching path-selected heavyweight lanes
• Commit and push safety preflights, including staged-index and outgoing-range secret scans

I also validated the full flow in the Debug app with a real workspace root containing nested Git repos. Once the repos were admitted by the workspace's existing ignore policy, they remained visible through the parent root and agents could retrieve their CMs while the parent graph completed normally.

[baron]

Reviewed exact PR head ad0112a against freshly fetched origin/main 64b49fb via synthetic merge d5c54f172f59634734008ba96e20a663a7b4ab59.

No actionable P0-P3 findings. Focused validation passed on the synthetic merge:

• GitBlobIdentityServiceTests (1 test, 0 failures)
• CodemapAutomaticSelectionGraphNativeTests (1 test, 0 failures)

Hosted raw-head checks are green. Validation limits: no separate full suite, lint, product build, or live-app validation was run on the synthetic merge.