Git snapshot pass gains race detection, pacing, and richer refusal reasons

What

• The snapshot builder now takes a passStartedAtMs/notOlderThanNs threshold, and a new sincePassStart flag on changed entries lets it produce a distinct error message when a file was edited right as the snapshot began, instead of mid-read.
• It also gains stageHooks, budgetMs, and lastDescribed parameters for controlling and describing the pass.
• --ignore-submodules=dirty is now added to the diff-tree comparison, and previously-verified entries are re-applied via update-index for unstable paths.
• Refusal results now carry a structured cause, such as { kind: "rules_unreadable" }, { kind: "staged_protected", count }, { kind: "credential_named", count }, or { kind: "committed_protected", count }.
• Snapshot output now also reports a withheld.unspellable category alongside the existing withheld categories.

Why

This makes it easier to tell what happened during a git snapshot: whether a file changed too close to when the snapshot started to be captured reliably, and exactly why any files were withheld or refused, rather than getting a generic failure.