[gobby-cli-#958] fix: restore full-stream NUL scan in gcode is_binary

#951 (CodeRabbit triage) reverted the #17356 loop back to a single 8192-byte
read while keeping the "null bytes anywhere in the stream" doc comment, so a
file with a NUL byte past the first 8KB was misclassified as text and indexed —
the late-NUL regression (Gobby #17344). Restore the chunked loop (already bounded
by MAX_FILE_SIZE via is_safe_text_file) and add a rationale comment so it is not
narrowed again.

Validation:
- cargo nextest run -p gobby-code -E 'test(/late_nul/)' with AND without default
  features: 3 passed (skips_content_only/ast_*_late_nul_byte, explicit route).
- cargo clippy -p gobby-code [--no-default-features] -- -D warnings: clean.
- cargo fmt --all --check: clean.
Note: 3 serial_db tests fail locally on a missing/dirty postgres test DB; they
pass in CI (which provisions a clean postgres service).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: joshwilhelmi

crates/gcode/src/index/security.rs

@@ -45,12 +45,24 @@ pub fn is_binary(path: &Path) -> bool {
         Ok(f) => f,
         Err(_) => return true,
     };
+    // Scan the whole stream, not just the first 8KB: NUL bytes can appear late
+    // (a clean prefix followed by binary garbage corrupts the index — gobby-cli
+    // #17356 / Gobby #17344). The read is bounded: `is_safe_text_file` already
+    // rejects files larger than MAX_FILE_SIZE before this runs, so the loop reads
+    // at most that cap. Do not narrow this back to a single read.
     let mut buf = [0u8; 8192];
-    let n = match file.read(&mut buf) {
-        Ok(n) => n,
-        Err(_) => return true,
-    };
-    buf[..n].contains(&0)
+    loop {
+        let n = match file.read(&mut buf) {
+            Ok(n) => n,
+            Err(_) => return true,
+        };
+        if n == 0 {
+            return false;
+        }
+        if buf[..n].contains(&0) {
+            return true;
+        }
+    }
 }
 
 /// Check if a path should be excluded.