fix(search): align watcher and walker path exclusions

[mavaali]

Reactive indexing could admit files from nested hidden paths and dependency directories that a full vault scan excludes. The walker, watch-time filter and event scheduler now share the same path-segment exclusion rule. This also rejects excluded events if the watcher emits them unexpectedly.

Regression coverage compares walker and watcher selection against the same files, checks leaked events, and exercises excluded directories created after startup with real chokidar. Ordinary dotted directories, root watching and existing extension handling remain unchanged. A full reindex removes any previously admitted excluded files.

Closes #537.

This path-selection fix is independent of the index-generation coordinator in #535 and can land first.

Validation: build and lint pass (six existing lint infos). Full suite: 4,861 passed, 17 skipped, using existing installed dependencies.

[claude]

isIgnoredVaultPath is a new exported function that now also changes listFiles's output (the .filter() on line 172), but the only test that exercises it is test/search/watcher.test.ts (via watchIgnored) — test/storage/local.test.ts has no direct case for it (e.g. nested dot-dirs or node_modules under listFiles). CLAUDE.md asks for tests to mirror src/ structure; consider adding a case to local.test.ts alongside the existing listFiles describe block so the storage-layer behavior is covered where it lives, not only transitively through the watcher.

[claude]

Review summary: Small, well-scoped change that unifies the vault path-exclusion rule (isIgnoredVaultPath) between the reactive watcher (src/search/watcher.ts) and the full-walk lister (src/storage/local.ts listFiles), fixing a real inconsistency: the old watcher only skipped top-level hidden dirs, while listFiles (via glob's dot:false default) already skipped hidden dirs at any depth -- so a doc in a nested dot-directory could get indexed live but vanish on the next full reindex. Good fix for keeping the SQLite index honestly rebuildable from disk, per CLAUDE.md.

No correctness bugs found. One test-coverage note left inline: the new exported isIgnoredVaultPath / the listFiles filtering change is only covered transitively via test/search/watcher.test.ts; test/storage/local.test.ts (where the function actually lives) has no direct case.

Minor non-blocking observation: the new .filter() in listFiles is currently a no-op given glob's dot:false default plus the existing /node_modules/ ignore pattern, but the comment makes clear it's meant as a shared boundary to guard against future drift between the two call sites, so not flagging it as an issue.

No violations of this repo's hard invariants spotted (frontmatter-only metadata, ephemeral/derived index, git-as-version-layer, Result<T, Error>, no classes).