feat(git): expose commit path provenance

[ohdearquant]

Summary

• retain canonical, secret-masked changed paths for every commit ingested by git.digest
• annotate code modules only through an exact, unique (snapshot revision, source path) match so repository or revision collisions fail closed
• parse Git's NUL-delimited history stream without pathname delimiter or Unicode assumptions and document first-parent merge semantics

Behavior

Commit provenance notes now carry sorted, deduplicated changed_paths derived from Git's raw
NUL-delimited output. The parser accepts both observed one- and two-NUL commit boundaries, preserves
delimiter-bearing and non-UTF-8 pathnames through deterministic lossy normalization, represents
empty commits, and uses first-parent diffs for merges. Credential-shaped path fragments are masked
before persistence.

When code-ingest data is present, module annotations are resolved against the source snapshot's
exact HEAD revision and source path. A unique match produces the commit-to-module link; duplicate,
cross-repository, or otherwise ambiguous candidates are skipped instead of fabricating provenance.
These facts make churn and co-change analysis derivable from the stored graph.

This is a stacked draft on #1619 because its exact snapshot-revision binding consumes the code-ingest
provenance contract introduced there. Issues #1600, #1603, and #1605 remain scoped exclusively to
the parent draft.

Validation

• full khive-pack-git unit, acceptance, and documentation tests
• direct full-history parser probe: 859 / 859 commits represented
• cargo test --manifest-path crates/Cargo.toml --workspace
• cargo check --manifest-path crates/Cargo.toml --workspace
• cargo clippy --manifest-path crates/Cargo.toml --workspace --all-targets -- -D warnings
• cargo fmt --manifest-path crates/Cargo.toml --all -- --check
• RUSTDOCFLAGS=-Dwarnings cargo doc --manifest-path crates/Cargo.toml --workspace --no-deps

Closes #1604

AI-assisted contribution: Codex prepared this change and PR description.