fix(desktop): disclose truncated repository file trees

[MajorTal]

I had more than 250 files and this bug was just misleading me...

Summary

• Keep the repository snapshot payload capped at 250 file previews.
• Report the full repository file count over Tauri.
• Show an honest "250 of N files" count and a truncation notice in Desktop.
• Cover committed trees and local worktrees with regression tests.

Root cause

The Rust parsers stopped after 250 entries and returned no total or truncation metadata. Desktop therefore presented the capped array length as the complete repository.

Testing

• just desktop-tauri-test (2,108 passed, 14 ignored; 3 diagnostic tests passed)
• just desktop-tauri-clippy
• cd desktop && pnpm test (3,926 passed)
• cd desktop && pnpm check
• cd desktop && pnpm build:e2e
• cd desktop && pnpm exec playwright test --project=smoke tests/e2e/project-file-tree.spec.ts

Manual verification

Open a repository with more than 250 files and select Files. The header shows "250 of files", and a notice states that some files and folders are not included.

Closes #4428

[Chessing234]

disclosing total_file_count + raising the cap is better than #4497's silent delete of snapshot helpers. looks mergeable if the new project_git_files module keeps the path-escape checks from the old parser.

[Chessing234]

total_file_count + truncation disclosure is the right fix for silent 250 caps; nicer than just bumping the limit.

[MajorTal]

looks mergeable if the new project_git_files module keeps the path-escape checks from the old parser.

Confirmed — the containment check moved verbatim. Diffing read_preview_content before and after, the only deltas are a reformatted signature (using the newly imported Path alias) and an inlined temporary:

-fn read_preview_content(
-    repo_dir: &std::path::Path,
-    path: &str,
-    size: Option<u64>,
-) -> Option<String> {
+fn read_preview_content(repo_dir: &Path, path: &str, size: Option<u64>) -> Option<String> {
-    let full_path = repo_dir.join(path);
-    let normalized = full_path.canonicalize().ok()?;
+    let normalized = repo_dir.join(path).canonicalize().ok()?;

Every guard in that function is unchanged:

• Path escape — canonicalize() on both the joined path and the repo root, then normalized.starts_with(repo_root), rejecting anything that resolves outside the repo (symlinks included, since canonicalization happens before the comparison).
• Size cap — MAX_PREVIEW_BYTES at 64 KiB.
• Binary rejection — NUL-byte scan, then String::from_utf8.

Scope is also unchanged: the containment check gates preview content, not a path's presence in the listing, exactly as before.

One note on the new total_file_count, since it feeds the truncation disclosure: parse_ls_tree increments it per ls-tree line, and the command runs ls-tree -r --long HEAD without -t, so subtrees are never emitted and the count is blobs only. parse_worktree_files increments only after its metadata.is_file() check. Both paths count files, not directories, so "showing 250 of N" reports N accurately.