feat(sync): --src-subpath + --exclude for monorepo subdir-source support

[jeremyknows]

Summary

Adds two flags to gbrain sync that together make Atlas-style monorepos (1 git repo, N logical sources at subdirs) work without any workarounds.

PR-A — --src-subpath <subdir>

• New discoverGitRoot() helper: git -C <path> rev-parse --show-toplevel walks up from any path to the git root — handles worktrees + submodules natively.
• Splits the implicit repoPath into two axes:
  • gitContextRoot — all git operations (rev-parse, diff, pull)
  • syncScopeRoot — file walking and imports
• Slugs stay relative to gitContextRoot so wiki/page1.md lands as slug wiki/page1, not page1, regardless of which subpath is synced.
• runImport() gains a slugRoot option to support this: walk from syncScopeRoot, compute slugs relative to gitContextRoot.
• manageGitignore() always resolves to git root even when repoPath is a subdirectory.
• Auto-discovery: passing a subdir directly as repoPath (no --src-subpath) also works — same code path.

PR-B — --exclude <glob> (repeatable)

• Exposes the existing internal SyncOpts.exclude field as a repeatable CLI flag.
• Works in both full-sync and incremental sync paths.
• Threaded into runImport() opts for full-sync paths.
• matchesAnyGlob promoted to export from core/sync.ts for reuse in import.ts.

Security guards

Guard	What it blocks
NAV-1	--src-subpath ../escape — realpathSync scope-entry check before any git op
NAV-1 TOCTOU	Symlink inside repo pointing outside — per-file realpathSync check during walk
NAV-2	gitContextRoot itself passed through realpathSync
NAV-4	Warning when --exclude patterns filter out all files
NAV-3 note	Git hooks (.git/hooks/) run during git pull — unchanged from current behavior; callers trusting remote repos already accept this risk

Tests

test/sync-monorepo.test.ts — 10 tests, all pass:

✓ back-compat: sync at git root without srcSubpath imports all files
✓ auto-discovery: repoPath is a git subdir — discoverGitRoot succeeds
✓ --src-subpath wiki: only wiki/ files are imported
✓ --src-subpath memory: only memory/ files are imported
✓ 2 sources in 1 repo: sync each scope independently, no cross-contamination
✓ path-traversal: --src-subpath ../escape is rejected before any git op
✓ path-traversal: symlink subdir pointing outside repo is rejected (NAV-1 TOCTOU)
✓ --exclude: single pattern excludes matching files from full sync
✓ --exclude: glob pattern with wildcard
✓ --exclude **/* emits warning when all files are excluded (NAV-4)

bun test test/sync-monorepo.test.ts  →  10 pass / 0 fail
bun run typecheck                    →  clean
bun run verify                       →  all checks pass

What was NOT tested

• Incremental sync with --src-subpath (requires 2 commits in a real git repo; incremental path uses inScope() filter on git diff output which is git-root-relative — tested manually by inspection but not automated here)
• Parallel workers + --src-subpath (PGLite forces serial; Postgres worker path is unchanged)

Motivation

Closes the gap for monorepo deployments where a single git repo contains multiple logical knowledge bases (e.g., wiki/, memory/, projects/). Previously, gbrain sync required the git root and imported everything; there was no way to scope a sync to a subdirectory. With --src-subpath, each logical source can be synced independently with its own source ID, enabling per-source search and cross-contamination prevention.

Relates to #753.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews

[jeremyknows]

Follow-up commit: b4bfb70 — fix(sync): gate slugRoot on opts.srcSubpath

Discovered during live testing: the original PR applied slugRoot = gitContextRoot whenever syncScopeRoot !== gitContextRoot, which affected all subdirectory sources — not just --src-subpath cases. Sources registered with a direct subdirectory path (e.g., sources add wiki --path ~/atlas/shared/wiki) carry slug: frontmatter fields matching their path-relative slug (agent-roster, not shared/wiki/agent-roster). The mismatch caused 80/144 wiki pages to fail import with SLUG_MISMATCH.

Fix: slugRoot = (opts.srcSubpath && scopeRel) ? gitContextRoot : undefined

Git-root-relative slugs are only activated when --src-subpath is explicitly passed. Back-compat with existing sources that point directly at subdirectories is preserved.

All 10 tests still pass.