discover: unify the exclusion predicate across all filesystem walkers

[DeusData]

Umbrella follow-up from the #517/#543/#793 review. Today each walker owns a private skip predicate: main discovery honors built-ins + .gitignore stack + .cbmignore; the pkgmap walk honors only hardcoded built-ins; the path-alias walk has its own hardcoded list; envscan's walker is currently uncalled. Result: contradictory semantics (a dir un-skipped by negation would still be vetoed in pkgmap but descended by path_alias).

Target design:

• ONE shared exclusion predicate: built-in skips + gitignore stack + .cbmignore incl. negation (last-match-wins via cbm_gitignore_match_result).
• Non-negatable safety core: .git, node_modules, worktree-internal dirs stay skipped regardless of negation (repo-committed .cbmignore must not defeat OOM/safety skips, see index_repository ignores .git/info/exclude (only .gitignore honored) → indexes excluded worktrees → OOM #489).
• Transport: fix(pipeline): honor discovery exclusions in pkgmap/envscan repo walks #793's materialized excluded-roots list; per-walker hardcoded lists demoted to delegating fast paths so negation overrides propagate.
• Incremental-path plumbing: pipeline_incremental's ctx lacks excluded_dirs, so merge_pkg_entries walks unexcluded on incremental reindexes (residue of pkgmap/envscan repo walks bypass gitignore exclusions - 15+ min apparent hang on repos with large ignored artifact dirs #792, see fix(pipeline): honor discovery exclusions in pkgmap/envscan repo walks #793 review).

Related: #543 (negation, being re-implemented on cbm_gitignore_match_result), #793, #510 (parent-gitignore half still open), #489.