fix untrusted-workspace RCE in dugite git resolution (T-98)

Drop the workspaceRoot parameter from resolveToolchainPaths /
Toolchain.resolvePaths entirely. The old code resolved
\`<workspaceRoot>/native/dugite/bin/git\` as the git binary before
falling back to PATH — a malicious repo could commit an executable
at that path and clide would run it on the first auto-fired
git.status (which fires automatically on workspace open).

Dugite now resolves against trusted locations only:
1. CLIDE_DUGITE_DIR env var (dev override).
2. <exe-parent>/dugite/bin/git (production bundle).
3. <exe-parent>/lib/dugite/bin/git (alternate bundle layout).

Test plants `native/dugite/bin/git` in a temp workspace and asserts
the resolved git path is NOT inside the workspace.

Callers updated (8 sites): main.dart, backend_entry.dart twice,
test_app.dart three times (compute now wraps a no-arg call), plus
five test fixtures. backend.dart's now-vestigial hintRoot left in
the struct for cleanup under T-99.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test/pql/client_test.dart

@@ -12,7 +12,7 @@ import 'package:test/test.dart';
 void main() {
   late PqlClient pql;
   setUp(() {
-    final toolchain = ToolchainView.resolved(resolveToolchainPaths(Directory.current.path));
+    final toolchain = ToolchainView.resolved(resolveToolchainPaths());
     pql = PqlClient(workDir: Directory.current, toolchain: toolchain);
   });