refactor(core): reconcile current watcher policy

[kitlangton]

Why

Location watcher reconciliation captures an ignore policy before asynchronous repository-target discovery, then uses generation numbers to reject stale captures. Reading the current policy after discovery preserves the same behavior without carrying a snapshot across the wait.

What Changes

• Resolve the target under the existing permit, then read policy.current() before deciding whether to watch it.
• Remove the generation counter, per-call token, stale-generation comparisons, and policy argument.
• Keep the initial shutdown guard. The shutdown finalizer acquires the same permit, so it cannot change stopped while reconciliation holds it.
• Add a deterministic test that pauses target discovery, changes the ignore policy, and confirms no stale subscription starts. It also checks re-enabling, duplicate reconciliation, and subscription release on scope closure.

The previous generation checks already handled this race. This is a simplification, not a new refresh or watcher policy. The permit, plugin-activation wait, duplicate-subscription check, and close-before-replacement ordering remain unchanged.

Scope

Only Location watcher reconciliation and the existing watcher test file. No changes to policy APIs, native watcher implementations, or general filesystem containment.

Verification

# packages/core; CI is unset so local native watcher tests run
env -u CI RECORD=false bun --no-env-file run test test/filesystem/watcher.test.ts test/filesystem/location-watcher-policy.test.ts test/vcs.test.ts
bun typecheck

# Repository root
bunx prettier --check packages/core/src/filesystem/location-watcher.ts packages/core/test/filesystem/watcher.test.ts
bunx oxlint packages/core/src/filesystem/location-watcher.ts packages/core/test/filesystem/watcher.test.ts --format=json

# Also run by the repository's pre-push hook
bun typecheck

The new race test uses deferred synchronization, a gated real realPath call, and an instrumented watcher subscription. Temporarily moving the policy read before target discovery made it fail with an unwanted subscription; the correct ordering was restored before the final checks. Existing native watcher tests run separately against the local filesystem.

49 tests passed across three files, including local native watcher cases. Core typechecking and formatting passed. Scoped lint reported zero errors and one existing consistent-return warning in target discovery. The pre-push workspace typecheck passed all 33 tasks, with 27 cache hits.