fix(core+cli+loom): core-0.10.1 / cli-3.49.2 / loom-0.7.1 — every project-wide walker skips nested checkouts (#434)

[montfort]

Follow-up to #434. #435 fixed Baton; this PR fixes the rest.

Problem

straymark-core's source scanner, and two CLI walkers, descend into another checkout nested in the project and read it as the project's own code. That covers a linked git worktree (.worktrees/<name>/), a submodule and a nested clone. They only skip a fixed list of names.

Demonstrated read-only on an adopter repository with one worktree inside: straymark architecture generate --out <scratch> produced 15 components, one of them .worktrees (globs: [".worktrees/**"]). That component was a full copy of the repo, 5606 source files against 5235 in the real tree. With this branch: 14 components, no .worktrees.

Change

• straymark-core 0.10.1 adds walk::is_nested_checkout: a sub-directory with its own .git (file or dir) is another checkout. The check is structural, so it needs no gitignore parsing and nothing for adopters to configure. architecture::collect_source_files uses it, which fixes:
  • architecture generate | sync | validate and status --where;
  • Loom's architecture view and Intent plane;
  • Baton's overlay.
• CLI 3.49.2: tree_grep (behind followups verify --claims and analyze declared-vs-wired) and the analyze walker use the same rule. A worktree copy no longer counts as "callers" of a symbol, and its functions are no longer analyzed twice.
• Loom 0.7.1: rebuilt against core 0.10.1. No Loom code change.
• Baton now re-exports the core rule instead of keeping its own copy. Its behavior is unchanged, so there is no Baton release.
• Dependency bound: straymark-core moves to 0.10.1 in cli, loom and baton in the same commit (the feat(architecture): language/structure-agnostic, configurable seed scanner (#279) #282 lesson).

Validation

• cargo test --workspace: 1041 passed. The new tests cover core::walk and each of the three walkers, and every walker test fails with the guard removed. One analyze fixture first used vendor/, which analyze already excludes, so it passed without the fix; it was moved to third_party/.
• Clippy: core and Baton are clean with -D warnings, Loom is clean, and the CLI stays at its baseline (18/24).
• straymark validate reports 0 errors. AILOG: AILOG-2026-09-18-001.

Release after merge

Tag cli-3.49.2 (its workflow publishes straymark-core 0.10.1 to crates.io first) and tag loom-0.7.1.

🤖 Generated with Claude Code