Fix submodule package bootstrap boundaries

[chubes4]

Summary

• exclude declared Git submodule roots from generic dependency-root discovery by default
• add an explicit .datamachine/worktree-bootstrap.json opt-in contract and structured skipped-root evidence
• cover superproject, opted-in submodule, missing checkout, space-containing paths, and ordinary monorepos

Closes #890

Verification

• php tests/worktree-bootstrap-submodules.php
• for file in tests/*.php; do php "$file" || exit 1; done
• composer validate --strict
• PHP lint for changed files and git diff --check

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode with openai/gpt-5.6-terra
• Used for: implementation, tests, and verification

[homeboy-ci]

Homeboy Results — data-machine-code

Lint

❌ review lint — failed

ℹ️ Auto-fix: homeboy lint data-machine-code --path /home/runner/work/data-machine-code/data-machine-code --changed-since 91a89e2 --fix (or homeboy refactor data-machine-code --path /home/runner/work/data-machine-code/data-machine-code --changed-since 91a89e2 --from lint --write)
ℹ️ Some issues may require manual fixes
ℹ️ Full options: homeboy self docs commands/lint
Deep dive: homeboy review lint data-machine-code --changed-since 91a89e2

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-data-machine-code-review-lint-quality-Linux-node24 contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-data-machine-code-review-lint-quality-Linux-node24 contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/data-machine-code/actions/runs/29213159756

Tooling versions

• Homeboy CLI: homeboy 0.281.20+123145ee082b+0cb67ad
• Extension: wordpress from https://github.com/Extra-Chill/homeboy-extensions
• Extension revision: 79dd370c
• Action: unknown@unknown