Fix hooks hanging on repos with nested gitignored git repos

[korboybeats]

Summary

• scanner/astgrep.go: ScanDirectory now detects subdirectories containing their own .git and passes --globs '!dir/**' exclusions to ast-grep. Previously, ast-grep treated nested .git dirs as separate repo boundaries, ignoring the parent .gitignore and scanning thousands of files indefinitely.
• cmd/hooks.go: findChildRepos now uses git check-ignore to skip gitignored child repos. Previously it would run full codemap trees on massive ignored directories.

Problem

In repos that contain large gitignored subdirectories with their own .git (e.g. a cloned freerdp/ with 3,600+ files), both codemap hook prompt-submit and codemap hook session-start hang indefinitely. This completely blocks Claude Code — /resume stops working since the UserPromptSubmit hook never returns.

Root cause

1. ScanForDeps → ast-grep scans the entire root directory. When it hits a nested .git, it treats it as a separate repo boundary and ignores the parent's .gitignore, scanning all files in that subdirectory.
2. findChildRepos doesn't check .gitignore, so hookSessionStartMultiRepo runs full codemap trees on gitignored repos.

Test plan

• Verified codemap hook prompt-submit completes instantly (was hanging forever)
• Verified codemap hook session-start completes instantly (was timing out at 15s+)
• Verified gitignored child repos (freerdp/, openssl-src/) are properly excluded
• Verified non-ignored child repos still appear in multi-repo context