fix untrusted-workspace RCE in dugite git resolution (T-98)

Drop the workspaceRoot parameter from resolveToolchainPaths /
Toolchain.resolvePaths entirely. The old code resolved
\`<workspaceRoot>/native/dugite/bin/git\` as the git binary before
falling back to PATH — a malicious repo could commit an executable
at that path and clide would run it on the first auto-fired
git.status (which fires automatically on workspace open).

Dugite now resolves against trusted locations only:
1. CLIDE_DUGITE_DIR env var (dev override).
2. <exe-parent>/dugite/bin/git (production bundle).
3. <exe-parent>/lib/dugite/bin/git (alternate bundle layout).

Test plants `native/dugite/bin/git` in a temp workspace and asserts
the resolved git path is NOT inside the workspace.

Callers updated (8 sites): main.dart, backend_entry.dart twice,
test_app.dart three times (compute now wraps a no-arg call), plus
five test fixtures. backend.dart's now-vestigial hintRoot left in
the struct for cleanup under T-99.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test/git/client_test.dart

@@ -10,7 +10,7 @@ import 'package:clide/src/git/client.dart';
 import 'package:clide/src/git/operations.dart' show GitException;
 import 'package:test/test.dart';
 
-ToolchainView _toolchain() => ToolchainView.resolved(resolveToolchainPaths(Directory.current.path));
+ToolchainView _toolchain() => ToolchainView.resolved(resolveToolchainPaths());
 
 Future<Directory> _newRepo({String filename = 'file.txt', String contents = 'hello\n'}) async {
   final dir = await Directory.systemTemp.createTemp('clide-git-client-');