fix untrusted-workspace RCE in dugite git resolution (T-98)

Drop the workspaceRoot parameter from resolveToolchainPaths /
Toolchain.resolvePaths entirely. The old code resolved
\`<workspaceRoot>/native/dugite/bin/git\` as the git binary before
falling back to PATH — a malicious repo could commit an executable
at that path and clide would run it on the first auto-fired
git.status (which fires automatically on workspace open).

Dugite now resolves against trusted locations only:
1. CLIDE_DUGITE_DIR env var (dev override).
2. <exe-parent>/dugite/bin/git (production bundle).
3. <exe-parent>/lib/dugite/bin/git (alternate bundle layout).

Test plants `native/dugite/bin/git` in a temp workspace and asserts
the resolved git path is NOT inside the workspace.

Callers updated (8 sites): main.dart, backend_entry.dart twice,
test_app.dart three times (compute now wraps a no-arg call), plus
five test fixtures. backend.dart's now-vestigial hintRoot left in
the struct for cleanup under T-99.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lib/kernel/src/backend_entry.dart

@@ -45,11 +45,10 @@ void backendEntry(BackendBootMessage boot) {
   late Toolchain toolchain;
 
   // Phase 1: resolve toolchain — just find binaries, don't init services.
-  // We need a project root for dugite paths. Use a sensible default;
-  // the real project comes from project.open.
-  final resolveRoot = boot.hintRoot ?? Platform.environment['HOME'] ?? '/tmp';
+  // Dugite is resolved against the install dir; per T-98 the project
+  // root is never inspected during toolchain resolution.
   toolchain = Toolchain();
-  toolchain.applyResolved(resolveToolchainPaths(resolveRoot));
+  toolchain.applyResolved(resolveToolchainPaths());
 
   // Listen for messages from the frontend.
   requestPort.listen((message) async {
@@ -77,10 +76,10 @@ void backendEntry(BackendBootMessage boot) {
       final projectPath = message['path'] as String;
       final workDir = Directory(projectPath);
 
-      // Re-resolve toolchain with the actual project root (finds
-      // dugite in native/dugite/, etc.)
+      // Re-resolve toolchain. Project path is not inspected (T-98);
+      // dugite still comes from the install dir + env override.
       toolchain = Toolchain();
-      toolchain.applyResolved(resolveToolchainPaths(projectPath));
+      toolchain.applyResolved(resolveToolchainPaths());
 
       // Clear existing handlers and re-register with new project.
       dispatcher.clear();