Never hide a tracked file behind .gitignore; add --no-ignore

[bitWarrior]

git's rule is that an ignore pattern has no effect on a file it already
tracks. CodeSnake applied .gitignore to everything a directory walk found, so
a pull request could add a file, ignore it, git add -f it, and
codesnake check src/ would never see it -- exit 0 with the file in the tree.
Reproduced both spellings: an ignored file, and a tracked file inside an
ignored directory, where the walk pruned the directory before reaching it.

Tracked paths are now exempt from ignore filtering, and a directory holding a
tracked file is walked rather than pruned. Untracked ignored files -- build
output, generated code -- are still skipped, so the noise the filter exists to
suppress is unaffected. The fix needs no flag, so CI written before this
release is covered simply by upgrading, and the repository's own self-check no
longer needs --no-ignore to be a real gate.

The tracked set comes from git ls-files -z --full-name, about 2 ms here and
run once per walk. Anything going wrong -- no git, not a repository, a timeout
-- yields an empty set, which restores the previous behavior rather than
silently widening or narrowing the scan.

--no-ignore is kept, with its meaning narrowed to what it is now actually for:
covering untracked ignored files, or a tree that is not a git repository.

Extract _load_ignore_state so iter_python_files stays under the complexity and
length thresholds the tool enforces on everything else.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_0114gUUe4CxYr8W8oC95ffmD