Fix Private Context tree label privacy collision

[gavinjudd]

Reproduced live P1

The selected private repository contains a conventional tree-only tests directory. The safe aggregate also uses the generic word tests, so the value-aware privacy scanner treated fixed product vocabulary as though it were a leaked path and rejected the complete Private Context result.

No private identifier, path, URL, source, token, or aggregate was emitted by the failed run.

Correction

• Continue scanning every blob and submodule path.
• Continue scanning every tree, blob, commit, and revision SHA.
• Exclude only tree-entry directory labels from value matching. Git cannot retain an empty directory, so source-bearing directories remain covered by descendant blob or submodule paths.
• Preserve the aggregate shape gate and all existing value scans for repository identifiers, installation identifiers, paths, URLs, source, and tokens.
• Add a regression fixture with a conventional tree-only tests label and a source-bearing descendant path.

Evidence

• Reproduced against the one selected live staging installation.
• Repaired live collector returned one analyzed repository, four aggregate receipts, 15 bounded requests, scoreInfluence: 0, publicWinnerInfluence: 0, and persisted: false.
• Full local verify passed: 874 tests passed, one intentionally skipped, package acceptance passed, and canonical fixture hashes remained unchanged.
• No npm, tag, Release, deployment, App permission, key, secret, or installation-selection mutation.