Git-aware workspace snapshots include mutable .codebox control artifacts

## Problem

WP Codebox `v0.12.25` correctly excludes Git-ignored dependency artifacts during runner-workspace publication, but its Git-aware snapshot now includes untracked `.codebox` runtime control files when the target repository does not independently ignore that directory. Those files mutate after approval, so publication fails with `Runner workspace changed after approval; refusing publication.`

## Evidence

- Acceptance run: https://github.com/Automattic/build-with-wordpress/actions/runs/29627878516
- Uploaded result: https://github.com/Automattic/build-with-wordpress/actions/runs/29627878516/artifacts/8424487221
- WP Codebox `v0.12.25` was selected.
- Dependency installation, build, verification, and scoped drift all passed.
- The target repository ignores `node_modules/` but does not ignore `.codebox`.

## Root cause

PR #1845 replaced recursive workspace traversal with `git ls-files --cached --others --exclude-standard`. The previous traversal explicitly skipped `.codebox`, but the replacement relies only on repository ignore rules. Runtime-owned `.codebox` files therefore enter snapshots in repositories that do not declare that internal exclusion.

## Expected behavior

- `.codebox` remains an unconditional runtime-control exclusion from publication and integrity snapshots.
- Git tracked and untracked-nonignored workspace files continue to define publishable content.
- Tests prove mutable `.codebox` state does not invalidate an approved patch, while publishable changes and symlinks still fail closed.

Start with the Git-aware snapshot traversal introduced by PR #1845 and the related integrity and publication tests. Reproduce against a repository that does not ignore .codebox, then verify mutable .codebox state is excluded while publishable changes and symlinks still cause publication to fail closed.

Written by the indexing model from the issue text.