chore: drop optional libgit2 dependency (keep git log fallback)

[DeusData]

What

Removes the optional libgit2 dependency entirely. The git log popen
fallback — which release binaries already used — becomes the sole
git-history implementation. HAVE_LIBGIT2 no longer exists anywhere in
the tree.

Why

libgit2 is licensed GPLv2-with-linking-exception, and this project is
deliberately GPL-free (see scripts/license-policy.json). libgit2 was
only a faster git-history path, auto-detected via pkg-config and guarded
by HAVE_LIBGIT2, always sitting behind a popen("git log ...") fallback.
Release binaries are built without libgit2, so they already ran the
fallback — meaning there is no change to shipped behavior.

Files touched

• src/pipeline/pass_githistory.c — collapse the HAVE_LIBGIT2 #ifdef
  so only the popen parse_git_log remains; drop the now-unused
  <git2.h> / <time.h> includes.
• internal/cbm/cbm.c, internal/cbm/cbm.h, src/main.c,
  src/foundation/subprocess.c, src/mcp/index_supervisor.h — remove the
  libgit2 mimalloc allocator bind + its >=1.7.0 version guards; keep the
  tree-sitter + sqlite3 binds; correct the comments.
• Makefile.cbm — remove the optional-libgit2 pkg-config detection block,
  the REQUIRE_LIBGIT2 error gate, and all LIBGIT2 CFLAGS/LIBS/FLAGS.
• .github/workflows/_test.yml — drop the REQUIRE_LIBGIT2 test-matrix
  leg and its libgit2-dev/pkg-config apt install.
• flake.nix — drop libgit2/pkg-config from the dev shell (dead dep).
• scripts/security-allowlist.txt — comment now says "git log" instead of
  "fallback when libgit2 not available".

Tradeoff

A local dev build that had libgit2 installed loses the (slightly faster)
libgit2 history path. Release binaries are unaffected — they never linked
libgit2.

CI-sensitivity note

Edits .github/workflows/_test.yml: removes one REQUIRE_LIBGIT2 matrix
leg and its apt install → lower CI cost. No new gating jobs, no
2x/UI-build cost, no trigger-scope change.

Verification

• grep for libgit2|HAVE_LIBGIT2|LIBGIT2|git_libgit2|git_allocator|git2
  across src/ internal/ Makefile.cbm .github/: empty (only the
  historical tests/windows/RED_TEST_ANALYSIS.md analysis doc still
  mentions it, intentionally left untouched).
• Production build (make -f Makefile.cbm cbm): clean, no warnings;
  compile lines contain no -DHAVE_LIBGIT2; link line has no libgit2 libs.
• ASan test build (make -f Makefile.cbm build/c/test-runner): clean.
• test-runner pipeline: 215 passed — all 9 githistory_* tests green.
• test-runner integration git_context: 27 passed.
• End-to-end: indexing a real 3-commit git repo logs
  pass.done pass=githistory commits=3 edges=1 — the popen parse_git_log
  parses real history and produces the FILE_CHANGES_WITH coupling edge.

Merge as a merge commit (not squash).