fix: address codex review round 3

glob leaked VCS internals when the model rooted the search AT a VCS
directory (path: '.git' or 'sub/.git'): the prune glob !**/.git is
matched against root-prefixed candidate paths, which never end in the
directory name when the walk starts inside it. Pair each VCS exclude
with a contents glob (!**/<name>/**), verified empirically to exclude
relative, nested, and absolute VCS roots while leaving broad searches
untouched. Pinned by the command-construction test and a real-rg
integration case rooting at .git.

packages/fs/tool-fs-search/tests/integration.spec.ts

@@ -87,6 +87,12 @@ describe.skipIf(!hasRg)('search tools over the real bash executor + real rg', ()
       expect(text(await call('glob', { pattern: '*.nomatch' }))).toBe('No files found')
     })
 
+    it('excludes VCS internals even when the search root IS the VCS directory', async () => {
+      // The prune glob alone never matches root-prefixed paths when rg is
+      // rooted at .git; the paired contents glob keeps the exclusion airtight.
+      expect(text(await call('glob', { pattern: '*', path: '.git' }))).toBe('No files found')
+    })
+
     it('classifies an invalid glob as SEARCH_INVALID_PATTERN', async () => {
       const result = await call('glob', { pattern: '[' })
       expect(result.isError).toBe(true)