perf(core): prune package discovery walks

[ghost]

Description (What)

Syncpack now returns the same package manifests while doing substantially less filesystem work.

With workspace sources such as apps/* and libs/*, discovery previously descended into every nonignored root directory and every directory below each project, then discarded files that could not match. It now descends only through apps, libs, and their immediate workspace directories. Unrelated caches and deeper paths such as apps/web/src are not traversed.

The walker derives safe directory prefixes from positive source globs, leaves root and nested gitignore handling independent, and applies complete source matching to files afterward. Recursive sources such as apps/** remain recursive. Patterns that cannot be safely analyzed fall back to the previous broad traversal, avoiding false negatives.

Justification (Why)

Large generated trees could dominate runtime and trigger thousands of unnecessary filesystem inspections, including endpoint-protection interception, despite being unable to contain a matching manifest. This makes discovery proportional to bounded workspace paths without changing command results or configuration.

How Can This Be Tested?

• cargo test --locked -- --nocapture --color=always
• cargo clippy --tests --verbose -- -D warnings
• cargo fmt --all -- --check --verbose

Regression, differential, and traversal-property checks cover bounded, recursive, negated, ambiguous, dotfile, custom JSON, and gitignored sources.

Benchmarks

Hyperfine on the same host. Release rows used 5 warmups and 30 runs; the debug traversal row used 2 warmups and 10 runs.

40k-file case	Build	Before	After	Change
Gitignored cache	Release	29.1 ms	9.0 ms	69% faster
No-cache control	Release	9.5 ms	8.7 ms	Within noise

Closes #338.