fix: skip hidden directories in discovery; read-only remote observation for quarantine

[rldyourmnd]

Summary

Two defects found by an estate workspace audit:

• Discovery scanned hidden directories. excludedDirectory carried a
  fixed name list, so tool-state and fixture trees such as .tmp/ were
  walked to depth 8 and manufactured hundreds of anchor-required and
  path-unreadable findings for synthetic repositories. Now every
  dot-prefixed directory except .git is skipped; .git stays the
  discoverable boundary. Regression test proves a repository under
  .tmp/ is not discovered while a plain one is.

• Checkout quarantine required a push-capable remote to plan.
  observeCheckoutForQuarantine validated the push URL, so SSH/HTTPS
  remotes were rejected with ErrNetworkMutationDisabled even though
  the operation only runs ls-remote — a read. The observation now
  validates the fetch URL (validatedRemoteURL, credential-free
  https/ssh/file) and observeRemoteRef permits those transports;
  validatedPushURL still gates every mutation path unchanged.

Test plan

• go test ./core/discovery ./core/providers/git — new tests +
  existing clean/dirty/worktree/identity cases green
• go test ./... — green
• scripts/validate_shell.sh, validate_go_core.sh --quick — PASS
• python3 -m pytest — 81 passed
• go build -trimpath ./core/cmd/gds — clean