fix: refuse incomplete sparse onboarding

[johnson-ricon]

Summary

• refuse tracked-plaintext onboarding when a candidate is absent from the worktree
• keep sparse-checkout failures before git-crypt, attributes, manifest, or hook mutation
• retain the candidate snapshot through setup readiness validation

Why

PR #197 counts tracked plaintext from the full index, but notes stage --all can only process materialized readable files. In a sparse checkout, setup could report two candidates, stage one, and commit the other as a plaintext readable path behind the new notes/** encryption attribute. The ordinary commit hooks allowed that mixed tree; notes verify-blobs --strict then failed on the omitted path.

This focused fix makes incomplete materialization a clear pre-mutation refusal.

Validation

• sparse regression: pass
• complete repository suite: 467 BATS cases (461 passed, 6 existing environment skips) and 9/9 Python passed
• all 8 configured Codebase lints
• mise run doctor (README and lints pass; optional clone-local pre-commit hook absent)
• readme build --check
• Bash syntax and git diff --check

Fix-it for #197. Targets junior/onboard-existing-plaintext; does not merge or release.