…(#2682)

* [wip] claim work on fix-share-receive-ghost-candidate

* test(open-knowledge): pin share-receive ghost candidate gates

Add failing tests for the two coordinating gates that let a ghost
directory (exists on disk, only .ok/local droppings, no .git, no
.ok/config.yml) be presented as a share target with a false branch-match
claim:

- Gate A: annotateMissing must flag a ghost directory as not present so
  the share filter drops it (state-store.test.ts).
- Gate B: selectCandidate must never crown a sole candidate whose
  gitDirKind is absent as a branch-match; the correct outcome is miss
  (candidate-selection.test.ts).
- End-to-end: resolveShareTarget through the production annotateMissing
  wiring returns miss for a real ghost fixture (resolve-share-target.test.ts).

These are RED; the fix lands separately.

* fix(open-knowledge): gate share-receive soft-match on a real git working tree

A sole recents candidate whose .git is absent could be crowned a
branch-match: the single-candidate soft-match trusted classifyBranchMatch's
null-HEAD sentinel without consulting gitDirKind, so a moved-away directory
holding only OK log droppings was presented as a share target with a false
"this branch is checked out here" claim. Require isGitWorkingTree(gitDirKind)
in the soft-match so a non-checkout falls through to miss.

* fix(open-knowledge): drop non-git-working-tree recents from share candidates

Defense-in-depth at the main-side share-admission boundary: a moved-away
directory survives the bare-existence missing filter (the still-running
server recreated it to write logs), so filter recents through
filterShareEligibleRecents before selection, keeping only paths that still
resolve to a real git working tree. Retarget the Gate A test onto the new
predicate; annotateMissing is left unchanged so the recents-list display
surface is unaffected.

* fix(open-knowledge): close remaining ghost shapes surfaced by local review

readGitDirKind is now path-exact and HEAD-verified: a .git found at an
ancestor, a shell .git/ holding only the shadow repo (a shape OK itself
creates at a moved-away path), and a stale worktree pointer are all
refused as share candidates instead of reporting a working tree. Gate A
is documented and test-pinned as load-bearing anchor integrity rather
than defense-in-depth, drops are logged by .git classification, and the
remaining unlogged selection outcomes (fallback, no-usable-candidate)
now emit the structured [receive] selection= line.

* fix(open-knowledge): errno-discriminate inaccessible .git in readGitDirKind

Review follow-up: existsSync collapsed EACCES onto malformed-pointer for
linked worktrees; statSync errno discrimination matches readHeadState one
level deeper. Selection-level tests now pin the full non-working-tree kind
set (malformed-pointer, inaccessible, stale worktree pointer fixture).

* docs(open-knowledge): correct stale gitDirKind doc after path-exact probe

GitOrigin-RevId: f3569a4aa849c70bd360018524dc25af6d493204