trace: make same-call worktree comparison Git-clean aware #3699

Context

Follow-up to #3625 and PR #3631. The PR is being narrowed to a raw staged-blob versus worktree-byte comparison, as requested in maintainer review.

That conservative comparison can keep a pending range when Git would consider the worktree clean. This issue tracks complete gitattributes and clean-conversion behavior separately.

Scope

• honor attribute precedence across system, global, repository, nested, and .git/info/attributes sources;
• honor core.attributesFile;
• reproduce text and EOL normalization, including text, -text, eol, and core.autocrlf;
• define safe behavior for filter.<driver>.clean and filter.<driver>.process without unexpectedly executing repository-controlled commands;
• include relevant mode comparison semantics.

Expected behavior

Same-call checkpoint reconciliation should distinguish a real unstaged edit from bytes that differ only because Git's clean conversion changes the indexed representation. Attribution must stay conservative when a configured transformation cannot be reproduced safely.

Acceptance criteria

• Tests cover global, local, nested, and info attribute sources.
• CRLF/LF behavior matches Git for text and binary paths.
• No-op and transforming clean filters have explicit, tested behavior.
• Repository-controlled filters are not executed implicitly without an approved security design.
• A documented fallback keeps uncertain paths pending instead of consuming attribution.