Tool performance improvements - #115

Recursive grep walked every directory even when callers only wanted
source files. Add an `exclude` option and pass its relative globs to
the find walker, which prunes matching directories before reading
their files.

Tests cover searches with and without exclusions, interaction with
the inclusion glob, and confirm that pruned files are not read.

A recursive grep issued three statements per file: the recursive-CTE
path resolve inside readFile, the chunk range read, and the blob fetch.
The traversal had already read the inode and size from vfs_dirents, so
the resolve was pure duplicate work — and it was the most expensive of
the three.

Carry inode and size out of the find walk (internally only; find()'s
public {path, type} shape is unchanged) and add
readCommittedFileByInode, which pulls a committed file's bytes straight
from the chunk store. Open write buffers are still honoured so an
in-flight write is not missed; pending creates have no inode and keep
the resolve path, as does grepping a single file directly.

Line framing is shared with the streaming decoder's semantics: a
trailing fragment without a newline is still a line and an empty file
yields nothing. Verified byte-identical against the streaming path for
empty files, missing trailing newlines, CRLF, unicode, and matches
straddling a 512KiB chunk boundary, with and without context lines.

  statements per file  3.0 -> 2.0 (the resolve CTE: 501 -> 1 for 500 files)
  grep over 18,963 nodes  11412 ms -> 814 ms (14x)

The push tick reads tombstones with
`WHERE rev > ? AND op = 'delete' GROUP BY path`. Neither existing
index serves it: `vfs_changes_by_rev(rev)` can drive the range but
leaves `GROUP BY path` to a sort, so the planner instead scans
`vfs_changes_by_path` in path order and ignores the rev predicate.

Add `vfs_changes_by_op_rev(op, rev)` with the equality column first
and the range column second. Register it as the schema v7 to v8
migration because the sync cursor and operation tables already occupy
versions 6 and 7.

The migration only adds an index, so existing tombstones remain
unchanged. Tests cover fresh and upgraded databases and confirm that
SQLite uses the index for the tombstone query.

just-bash's find and grep are filesystem-agnostic: they walk through
IFileSystem, one readdirWithFileTypes per directory. Against the
workspace stub every one is an RPC to the DO, so a recursive command
over a tree containing node_modules costs hundreds to thousands of
round-trips before any matching work happens.

Give the adapter an opt-in prefetch scope. On the first listing inside
a scope it reads the whole subtree with one server-side find() and
answers later readdirWithFileTypes calls from that snapshot. The shell
entrypoint opens a scope only for commands that actually traverse
(find, grep -r), picked by prefetch-policy.

Correctness constraints, each covered by a test:
  * the snapshot lives only for the command that opened it, so no
    listing is ever reused across commands;
  * every mutating adapter method drops it, so a walk that writes
    re-reads instead of trusting the snapshot;
  * paths outside the prefetched root fall through to a direct listing;
  * a failed prefetch degrades to direct listings rather than failing
    the command;
  * dofs's find reports "symlink" at runtime even though the published
    type is narrower, so links keep isSymbolicLink rather than being
    mislabelled as files.

The policy declines mutating traversals (-delete, -exec) where a
snapshot taken before the walk could describe entries the command
removes, and declines non-recursive greps that would not benefit.

  find /       412 -> 9 stub calls (45.8x)
  grep -rl /   832 -> 429 (1.9x; the traversal is gone, per-file reads
               remain)
Output is byte-identical with the scope on and off in every case.

Content prefetch was prototyped and rejected: file bodies can only be
reconstructed from grep matches lossily (a file with no trailing
newline comes back with one), and silently altering file content is
not worth the remaining round-trips.

diffWith computed the full worktree status matrix and then discarded
everything outside opts.paths with makePathFilter. isomorphic-git can
prune the walk itself, so the traversal was visiting — and stat'ing and
hashing — the entire tree to produce a result the caller had already
narrowed.

Pass the caller's paths through as filepaths. The library's matching
rule (exact path or directory prefix) is the same one makePathFilter
implements, so the filter stays the authority on what is emitted and
this is purely a traversal hint. Callers that name no paths keep
isomorphic-git's default of walking everything.

This only became expensive once node_modules was synced into the
worktree: a repo whose .gitignore does not cover it makes every scoped
diff pay for the vendor tree.

  300-package vendor tree, :
    unscoped  294 ms, 4,865 fs calls
    scoped     14 ms,    64 fs calls   (21x, 76x fewer calls)
  Scoped rows verified identical to the full run's src subset.

Prevent an invalidated in-flight subtree load from publishing a stale
directory snapshot after a concurrent mutation. A generation check now
limits cache publication to the active prefetch scope.

Keep the path-resolution savings from inode-based grep reads without
materializing whole files. Chunk bytes are loaded only as the line
scanner pulls them, preserving bounded memory use for large files.

Document the shared relative-glob exclusion behavior for find and grep, and add release metadata for the large-tree performance changes.