feat(discovery): VS Code/Cursor/Windsurf recents + git config readers (v0.1.1 prep 2/6)

New module: src-tauri/src/discovery_sources.rs. Read-only, budget-aware
readers for the high-signal sources that solve the "fresh PC, repo
isn't in default scan paths" cold-start problem.

Tier 1 — VS Code family `state.vscdb`:
  - Probes VS Code, Insiders, Cursor, Windsurf on both Windows
    (%APPDATA%\<App>\User\globalStorage\state.vscdb) and macOS
    (~/Library/Application Support/<App>/User/globalStorage/state.vscdb).
  - Opens each DB with SQLITE_OPEN_READ_ONLY + immutable=1 so a running
    IDE can't lock us out.
  - Single-query lookup of ItemTable['history.recentlyOpenedPathsList'],
    cap 80 entries.
  - Skips remote workspaces (vscode-remote://, WSL, SSH, devcontainer).
  - folderUri → repo candidate (confidence 82); fileUri → parent dir
    candidate (60); workspace → CodeWorkspace candidate (72).
  - 512MB sync size cap so a pathological Cursor DB doesn't pin first
    paint; deadline propagates through every call.

Tier 1b — `.code-workspace` expansion:
  - Multi-root workspaces resolved against the workspace file's parent
    dir; cap of 20 folders.

Tier 2 — git config hints:
  - `safe.directory` entries → concrete repo candidates.
  - `includeIf "gitdir:<pat>".path` → root pattern hints for the
    learning layer (commit 3).

URI decoder is a tiny inline percent-decoder + platform-aware path
builder (no `url` / `urlencoding` dep added). Windows decoder rejects
POSIX-style paths instead of inventing fake UNCs; macOS decoder takes
the decoded path verbatim. vscode-remote://, ssh://, untitled: are
rejected up front.

10 new unit tests cover URI decoding, deadline respect, empty/missing
DB, real SQLite round-trip, code-workspace expansion + cap, and bad
URI rejection. 30/30 Rust tests pass.

Module is wired into lib.rs but not yet used — that's commit 3's job.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: var-gg