Replace internal `git` CLI reads with gix (gitoxide)

## Problem

codewhale shells out to the real `git` CLI for all internal read operations — repository badge probes, workspace context, `@status`/`@diff` mentions, and the model-callable Git tools. After #5617, two costs remain:

1. **Process spawn overhead**: the internal probes still spawn roughly **48 git processes per minute** while the TUI is idle in a git repo (≈190/min before the lock-reduction issue). Each spawn pays process creation + CLI startup for a computation that is a few milliseconds in-process.
2. **Unnecessary dependency on the git binary**: internal badge and context reads could work purely from the repository's on-disk format, without requiring git to be installed at all.

## Proposed solution

Migrate codewhale's **internal read-only** git operations from the `git` CLI to **gix** (gitoxide, pure Rust). Requirement-level scope (implementation follows the project's own conventions; no specific files are prescribed). This issue only makes sense after the lock-reduction issue is merged: the migration replaces the lock-free CLI reads with in-process reads and removes the event-driven refresh path's remaining process spawns.

- Add `gix` as a workspace dependency, pinned to an exact version, with the minimal feature set covering the read paths.
- Replace the following internal operations with gix in-process equivalents:
- repository discovery / work-tree root resolution
- HEAD / branch resolution (including detached-HEAD short hash)
- working-tree status computation (staged / modified / untracked / conflicts)
- ahead/behind counts vs upstream
- worktree listing
- remote origin URL and git config reads
- commit log / show / blame (model-facing Git tool — may be a later phase)
- **Keep the `git` CLI for real write operations** (side-repo snapshot commits, worktree create/remove, branch deletion) and for agent-executed shell commands (`exec_shell` remains the model's surface and must stay a real CLI).

## Expected gains

- **Zero subprocess spawns for internal reads**: the idle ~48 processes/min (baseline after the lock-reduction issue) drop to **~0** — badge and context data become pure in-process computation.
- **No lock files, permanently**: gix reads never touch `.git/index.lock`, eliminating the commit-collision problem at the root, without environment-variable mitigations.
- **Faster refresh**: in-process status computation (~5-30ms) vs. process spawn + CLI startup per probe.
- **Works without the git binary**: badge and context reads succeed from the on-disk format even where `git` is not installed; write paths still report cleanly when git is missing.
- **Consistent with the event-driven direction**: when combined with `.git` metadata watching (lock-reduction issue, point 3), the refresh path becomes event-triggered in-process computation with near-zero idle cost.

No specific files are prescribed. Start by locating the existing internal git CLI read paths for repository discovery, status, branch and worktree data, remotes, configuration, and model-facing tools, then review the project's dependency conventions. Done means internal reads use gix without subprocesses or lock files, while write operations and exec_shell retain the git CLI.

Written by the indexing model from the issue text.