Preserve ignored path identity on POSIX

[hzw0813]

Summary

• preserve Git-reported ignored path identity with the repository's platform-aware normalizeRepoPath() instead of rewriting every backslash as /
• preserve the exact identity of explicitly allowed repository-local data artifacts with the same normalization rule
• add POSIX regressions for both directions: a literal-backslash LCOV artifact remains usable when explicitly supplied, while a distinct literal-backslash ignored runtime input cannot alias a slash-separated allowed LCOV artifact
• regenerate tracked dist and document the boundary fix

Why

The immutable workspace gate compared ignored filesystem inputs against a small allowlist for explicitly supplied data artifacts. Two code paths used unconditional replaceAll("\\", "/") normalization. That is correct on Windows, where \\ is a path separator, but incorrect on POSIX, where a backslash is a legal filename character.

As a result, a repository could contain two distinct POSIX paths such as coverage/proof.lcov and the single filename coverage\\proof.lcov. The old ignored-file parser collapsed both identities to coverage/proof.lcov. If the slash-separated LCOV artifact was explicitly allowed, the distinct ignored backslash-named file could be filtered out of the pre-execution rejection set as though it were the same artifact. Repository-defined checks can read that ignored file, so an immutable --run-checks analysis could consume off-snapshot runtime input without the gate noticing it.

The fix reuses normalizeRepoPath(): it converts the native separator only (\\ on Windows, / on POSIX) and therefore preserves literal POSIX backslashes. The allowlisted artifact path uses the same identity rule, avoiding both false aliasing and false rejection of a legitimately supplied POSIX filename containing a backslash.

Verification

• added an integrated regression where coverage/proof.lcov is allowed but a distinct ignored coverage\\proof.lcov is read by the repository test; analysis must reject before repository execution
• added an integrated regression showing an explicitly supplied literal-backslash LCOV artifact is still accepted on POSIX
• full npm test passed
• clean npm run clean && npm run build passed
• git diff --check passed
• tracked dist regenerated
• temporary updater workflow/script removed from the final diff