Optimize git status on mounts

[elithrar]

This speeds up git status on ArtifactFS mounts by letting Git avoid walking every clean tracked path through FUSE.

git status --short on large mounts was dominated by metadata lookups against clean tracked files. PR #22 improved hydration and indexing, but Git still refreshed the whole worktree through macFUSE.

• Add ReadDirPlus so directory listings can return child attributes without a per-entry lookup.
• Configure a repo-local fsmonitor hook and mark index entries fsmonitor-clean after the FUSE worktree is mounted.
• Enable fsmonitor on macFUSE by setting fsmonitor.allowRemote=true for managed gitdirs.
• Report exact dirty overlay paths from the fsmonitor hook so a single modified file does not dirty a whole subtree.
• Mark entries fsmonitor-clean only after the HEAD generation and runtime state are updated.
• Fix review findings around shell quoting, unknown-size ReadDirPlus hydration, OpenDir generation consistency, and update-index pipe cleanup.

Benchmark: local file:// repo with 20,000 tracked files, macFUSE mount, 3 timed runs after one warm-up.

case	before median	after median	change
clean git status --short --untracked-files=all	3.5845s	0.6701s	5.3x faster
one dirty tracked file	2.9218s	0.6716s	4.3x faster

The after run also verified git ls-files -f reported lowercase h for tracked entries, confirming Git considered them fsmonitor-clean. Local Git 2.54 fsmonitor probing during review confirmed omitted dirty tracked paths can be missed, and returning the dirty path reports the modification.

Verification:

go build ./cmd/artifact-fs && go vet ./... && go test ./... && git diff --check

Additional local validation during review:

• git diff --check
• go build ./cmd/artifact-fs
• go vet ./...
• go test ./...
• go test ./internal/gitstore ./internal/auth ./internal/logging ./internal/model ./internal/watcher
• Git 2.54 fsmonitor probe: omitted dirty tracked paths were missed, and returning the dirty path reported the modification.

The opt-in FUSE e2e suite was attempted with AFS_RUN_E2E_TESTS=1 go test -run TestE2E -v ., but this environment could not see /Library/Filesystems/macfuse.fs, so the FUSE cases skipped with macFUSE not installed. E2E benchmark coverage still needs macFUSE or /dev/fuse.

Relates to #24.