trace: safely snapshot tracked paths below ignored directories #3700

Context

Follow-up to #3625 and PR #3631. The PR is restoring the existing worktree snapshot behavior from main while narrowing its same-call fix, following maintainer review.

The existing walker prunes directories matched by .gitignore. A force-added tracked file below such a directory can therefore be absent from the snapshot.

Scope

• include tracked regular files below ignored directories without scanning unrelated ignored content;
• keep untracked ignored paths excluded;
• define the interaction with intent-to-add entries tracked in #3698;
• reject symlinked path components and final symlinks;
• avoid opening FIFOs, devices, sockets, and other non-regular files;
• keep every read confined to the checkout root.

Expected behavior

Tracked regular files receive correct before/after snapshots even below ignored directories. Expanding coverage must not allow path traversal outside the checkout or block on special files.

Acceptance criteria

• A force-added tracked file below an ignored directory is snapshotted and compared.
• An untracked ignored sibling is not snapshotted.
• Intent-to-add paths follow the semantics decided in trace: support advanced Git index semantics for same-call attribution #3698.
• Escaping and in-repository symlink ancestors are not followed.
• FIFOs and other non-regular files are checked before open and skipped.
• Race-enabled tests cover ignored-directory and path-safety behavior.