fix(kibitzer): honor .gitignore in the sidecar grep candidate list

Candidates now come from `git ls-files -z --cached --others --exclude-standard`
run in the workspace root when that root is inside a work tree, so the scan sees
what git would show and never reads an ignored tree (build output, caches,
vendored deps). The same symlink, size, binary and skipped-directory filters
still apply, the file budget still bounds the list, and any git failure - no
repo, a non-zero exit, a spawn error - falls back to the previous walk.