test(engine): tighten test-suite hermeticity and parent-aware subtest references

Two follow-ups deferred from the apply-path regression PR:

1. Scope the workflow-leakage scan to git-tracked files. The previous
   filepath.WalkDir-based walk failed go test ./... on any working-tree
   artefact (notes, build scratch, generated YAML) that happened to
   contain a banned phrase, even when no committed source violated the
   rule. The new committedTextFiles helper shells out to git ls-files
   so the guard is hermetic with respect to working-tree state.

2. Make TestNoDanglingSubtestReferencesInSource parent-aware. The
   previous flat map[slug]struct{} collector accepted a citation
   TestX/wrong as long as ANY test in the package had a subtest named
   "wrong" — the wrong-parent drift the guard claims to catch slipped
   through silently. The new findDanglingSubtestReferences helper
   parses test files via go/parser, collects t.Run literals scoped to
   each parent test function, and rejects citations whose slug does
   not match a subtest under that specific parent (exact or prefix
   match within the same parent).

Both helpers get focused unit tests with synthetic fixtures so the
contracts survive future refactors:

- TestCommittedTextFilesIgnoresUntrackedArtefacts builds a tiny
  temporary git repo with one tracked + one untracked file and
  asserts the helper returns only the tracked one.
- TestFindDanglingSubtestReferencesIsParentAware constructs a
  synthetic test source with two parent tests, asserts the same-parent
  exact match passes, the same-parent prefix match passes, and the
  cross-parent slug match is flagged as dangling.

The synthetic test source in (2) is assembled via string concatenation
so engine_test.go itself does not embed the literal Test<Name>/slug
patterns the production scanner would otherwise flag against this
package's real test list.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

Author: lexfrei