fix untrusted-workspace RCE in dugite git resolution (T-98)

Drop the workspaceRoot parameter from resolveToolchainPaths /
Toolchain.resolvePaths entirely. The old code resolved
\`<workspaceRoot>/native/dugite/bin/git\` as the git binary before
falling back to PATH — a malicious repo could commit an executable
at that path and clide would run it on the first auto-fired
git.status (which fires automatically on workspace open).

Dugite now resolves against trusted locations only:
1. CLIDE_DUGITE_DIR env var (dev override).
2. <exe-parent>/dugite/bin/git (production bundle).
3. <exe-parent>/lib/dugite/bin/git (alternate bundle layout).

Test plants `native/dugite/bin/git` in a temp workspace and asserts
the resolved git path is NOT inside the workspace.

Callers updated (8 sites): main.dart, backend_entry.dart twice,
test_app.dart three times (compute now wraps a no-arg call), plus
five test fixtures. backend.dart's now-vestigial hintRoot left in
the struct for cleanup under T-99.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lib/main.dart

@@ -65,9 +65,7 @@ Future<void> main() async {
   // With proper signing (Developer ID), no sandbox or isolate needed.
   final toolchain = Toolchain();
   if (!kIsWeb) {
-    const workspace = String.fromEnvironment('CLIDE_PROJECT');
-    final root = workspace.isNotEmpty ? workspace : Directory.current.path;
-    toolchain.applyResolved(resolveToolchainPaths(root));
+    toolchain.applyResolved(resolveToolchainPaths());
   }
 
   InProcessClient? ipcClient;