fix(pipeline): honor discovery exclusions in pkgmap/path-alias/envscan walks

[DeusData]

fix(pipeline): honor discovery exclusions in pkgmap/path-alias/envscan walks

Summary

The auxiliary filesystem walks — the pkgmap manifest scan (cbm_pkgmap_scan_repo), the tsconfig/jsconfig path-alias discovery (find_alias_files), and the env-URL scan — ignored the directory subtrees that discovery had already excluded (gitignore matches + hardcoded skip dirs). On a huge monorepo with a gitignored vendored tree this kept the pkgmap walk busy for ~15 minutes re-traversing directories the index never uses (#792, priority/high).

This distills PR #793 by Patrick (@Sowiedu) — thank you! The mechanism is applied as-is:

• New shared predicate cbm_pipeline_relpath_is_excluded (static inline, pipeline_internal.h): root-anchored prefix match with a /-boundary check, so vendor_big excludes vendor_big and vendor_big/lib/... but never vendor_bigger or src/vendor_big.
• Exclusion parameters threaded through cbm_pkgmap_scan_repo / cbm_pkgmap_build_from_repo, find_alias_files / cbm_load_path_aliases_excluded, and cbm_scan_project_env_urls_excluded.
• NULL-exclusion wrappers preserve the old signatures for existing callers.
• cbm_pipeline_ctx_t gains a borrowed excluded_dirs/excluded_count pair, populated from the pipeline's discovery results.

Added beyond #793

1. Incremental plumbing (pipeline: incremental reindex still walks excluded trees in pkgmap (residue of #792) #804). pipeline_incremental.c's extract ctx did not carry excluded_dirs, so on any incremental run with changed files, cbm_parallel_extract → merge_pkg_entries → cbm_pkgmap_scan_repo still walked the repo unexcluded — the pkgmap/envscan repo walks bypass gitignore exclusions - 15+ min apparent hang on repos with large ignored artifact dirs #792 walk survived on real incremental reindexes. The excluded list (via cbm_pipeline_get_excluded, populated by the discovery pass that routed to the incremental path) is now threaded into the incremental ctx and its path-alias load, the same borrow as the full path.
2. Regression tests (the PR had none; repo rule is reproduce-first):
   • pipeline_relpath_excluded_boundary — boundary semantics of the shared predicate (exact match, subtree, /-boundary vs. shared-prefix siblings, root anchoring, NULL/empty safety).
   • pkgmap_scan_repo_honors_discovery_exclusions — fixture repo with a control manifest and one inside an excluded subtree; the excluded manifest is not ingested, the control is.
   • envscan_walk_honors_discovery_exclusions — same shape for the env-URL walk.
   • path_alias_loader_honors_discovery_exclusions — same shape for the tsconfig loader.
   • Every test runs an unexcluded control first (both fixtures found) so the exclusion assertion cannot pass vacuously.
3. Narrative correction. The envscan walker (cbm_scan_project_env_urls) has no production callers today — it is exercised only by tests. Its header comment now says so; the exclusion plumbing is kept for consistency with the pkgmap/path-alias walks.

Red-first evidence

With the test additions kept and all src/ changes stashed (git stash push -- src/), the test build fails against the unfixed sources:

tests/test_pipeline.c:4801:17: error: call to undeclared function 'cbm_pipeline_relpath_is_excluded'
tests/test_pipeline.c:4862:44: error: too many arguments to function call, expected 2, have 4   (cbm_pkgmap_scan_repo)
tests/test_pipeline.c:4907:13: error: call to undeclared function 'cbm_scan_project_env_urls_excluded'
tests/test_path_alias.c:374:12: error: call to undeclared function 'cbm_load_path_aliases_excluded'

With the fix restored, the pkgmap test's own log lines show the behavior directly: control run pkgmap.scan_repo manifests=2, excluded run manifests=1.

Verification

• make -f Makefile.cbm cbm — -Werror clean.
• make -f Makefile.cbm lint-ci — cppcheck + clang-format + NOLINT check pass.
• ./build/c/test-runner pipeline path_alias (ASan/UBSan build) — 224 passed, 0 failed.
• ./build/c/test-runner incremental — 161 passed, 0 failed.
• Grep-verified both cbm_pipeline_ctx_t construction sites (pipeline.c:1269, pipeline_incremental.c:820) carry .excluded_dirs/.excluded_count.

Closes #792. Closes #804.