fix(edge-worker): stop-hook ignores pre-existing untracked files (CYPACK-1196)

[cyrusagent]

Assignee: @PaytonWebber (payton)

Summary

Fixes CYPACK-1196. The Stop-hook guardrail was treating every line of git status --porcelain (including untracked ?? lines) as unshipped work. Customers whose worktrees contained stray untracked files outside .gitignore (scratch files, env files, IDE artifacts) got wedged: committing was wrong, and the agent looped trying to satisfy a condition it could not resolve.

Approach

Layered fix that preserves the original guardrail goal (catching forgotten new files Cyrus wrote but didn't commit):

1. IntentToAddHook (new) — PostToolUse hook on Write/Edit/MultiEdit/NotebookEdit runs git add --intent-to-add on the file the tool touched. Intent-to-add marks the file as tracked-with-empty-content, so the guardrail (git diff semantics) surfaces it if left uncommitted. No-op for: non-git cwd, gitignored paths, already-tracked paths, missing paths.
2. Guardrail switches to tracked-only — inspectGitGuardrail now uses git status --porcelain --untracked-files=no. Combined with Say hi [CEE-574] #1, pre-existing untracked junk is ignored while forgotten new files Cyrus wrote still block.

SOLID notes

The new hook follows the same strategy pattern as PrMarkerHook:

• IntentToAddGitClient interface separates git/fs side effects (DIP)
• DefaultIntentToAddGitClient implements it against the real git binary (SRP)
• applyIntentToAdd holds the precondition policy as a pure function over the client (testable without spawning git)

Trade-off (documented in the issue)

Files created via Bash (e.g. echo > foo, codegen, scaffolders) that Cyrus forgets to git add are no longer flagged. Every variant of instrumenting Bash to close this gap either reintroduces Cooper's bug, adds significant per-call overhead, or relies on brittle command-line parsing. Failing safe in this direction (missed nag, not customer-blocking loop) is the right call; the PR-marker early-exit and the unchanged unpushed-commits check provide partial coverage.

Test plan

• inspectGitGuardrail returns null for the Cooper case (untracked-only worktree)
• inspectGitGuardrail still blocks on tracked-file modifications
• inspectGitGuardrail still blocks on --intent-to-add files (forgotten new files preserved)
• inspectGitGuardrail still blocks on unpushed commits
• applyIntentToAdd is a no-op for non-git cwd, missing paths, gitignored paths, already-tracked paths
• IntentToAddHook matcher covers Write/Edit/MultiEdit/NotebookEdit and excludes Bash/Read
• Full edge-worker test suite passes (630 tests)

---

Tip: I will respond to comments that @ mention @cyrusagent on this PR. You can also submit a review with all your feedback at once, and I will automatically wake up to address each comment.