fix(scanner): index dot-directories instead of skipping them by default

[nicknsheth-beep]

Problem

codemap --deps / --importers never index any file under a directory whose name starts with . (other than .git), with no config option to opt in. A project that keeps source under .agents/, .config/, etc. is silently invisible to codemap.

Repro

repro/
├── .git/
└── .agents/
    ├── a.js   # const b = require('./b');
    └── b.js

codemap --deps .
# before: "No source files found."

The identical files in a non-dot directory index correctly.

Root cause

The scanner shells out to ast-grep scan, which skips hidden files/dirs by default (--no-ignore hidden is ast-grep's own opt-out flag). codemap never passed that flag and had no config knob for it.

Fix

scanner/astgrep.go: pass --no-ignore hidden to ast-grep, paired with explicit --globs excludes for codemap's existing IgnoredDirs (.git, node_modules, vendor, testdata, build, dist, target, .venv, .idea, .next, ...) plus .codemap itself — so relaxing the hidden-file default doesn't start indexing .git internals or slow down large repos.

Second-order bug I found while testing this: --globs match the literal path handed to ast-grep with no notion of where the scan root begins, so a bare **/testdata/** exclude also matches when testdata is an ancestor of the scan root — exactly how this repo's own scanner tests are laid out (fixtures under ../testdata/...). Fixed by running ast-grep with cmd.Dir = root and "." as the scan path, so every walked path is root-relative. The existing filepath.Rel(root, m.File) fallback logic in astgrep.go already handles ast-grep now reporting root-relative paths, so nothing else needed to change.

Tests

scanner/astgrep_test.go:

• TestScanDirectoryInvokesAstGrepWithHiddenDirsEnabled — locks in the exact args and cmd.Dir, via a fake sg script
• TestScanDirectoryIndexesHiddenDirectories — end-to-end: a file under .agents/ indexes and its importer resolves
• TestScanDirectoryDoesNotExcludeRootsNestedUnderAnIgnoredDirName — regression test for the ancestor-name false-exclusion bug above
• TestScanDirectoryStillExcludesKnownNeverSourceDirs — .git, node_modules, vendor stay excluded with hidden-dir scanning on

go test ./... passes (all 17 packages), gofmt -l . and go vet ./... are clean.

Related: filing alongside two other independent fixes found during the same investigation (-C scoping, and coverage-honesty for unindexed files) — happy to merge in any order, this one has no dependency on the others.