fix(globals): make package-level lookup state immutable

[hammadmajid]

Description

Three small hardening items on mutable package-level state. None is a live bug; each is one edit away from becoming one.

Closes #18

Type of Change

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Performance improvement
• Refactoring or code cleanup
• Documentation update
• CI/CD or build workflow change

Key Changes

filter.BuiltinTypes unexported. An exported map is a writable global, and a FileTypeDef's Extensions/Filenames slices were writable through a read. Nothing writes it today and both readers run single-threaded before the pipeline starts — but one filter.BuiltinTypes[x] = … added later, plausibly for a --type-add flag, becomes a concurrent map write the moment type matching moves off the main goroutine, which is a hard runtime crash rather than something -race warns about first.

Now builtinTypes, with LookupType(name string) (FileTypeDef, bool) returning slices.Cloned slices. NewTypeMatcher routes through LookupType rather than reading the table directly: a couple of tiny clones once per process (type names come from CLI args) buys a single read path that cannot rot into a second, slice-leaking convention.

packMagic / idxV2Magic are now const strings. They were mutable []byte globals used as constants; any function in the package could overwrite the elements. pack.go already compared as a string; pack_index.go's bytes.Equal becomes an allocation-free string(data[:4]) != idxV2Magic.

Deleted the stale unused exclusion in .golangci.yml claiming field zlibPool is unused. Pooling landed — p.zlibPool is used twice in pack.go. nolintlint does not police issues.exclusions, so this would never have self-cleaned.

Verification & Testing

• Ran go test -v -count=1 ./...
• Ran go test -race -shuffle=on -count=1 ./...
• Ran go vet ./...
• Added or updated unit/integration tests
• Tested manually against sample Git repository histories

go build ./...                                     clean
go vet ./internal/filter/... ./internal/gitengine/ clean
go test -race -count=1 ./internal/filter/          ok 1.03s
go test -race -count=1 ./internal/gitengine/       ok 1.42s
gofmt -l                                           empty

grep -rn BuiltinTypes over the whole tree returns nothing.

TestLookupTypeReturnsCopy mutates the returned Extensions[0]/Filenames[0], re-looks-up to assert the builtin table is uncorrupted, asserts a matcher built afterwards still matches Dockerfile and my.dockerfile, and asserts an unknown type reports ok=false. Mutation: reverting LookupType to return def, true without the clone fails all four assertions.

One line of pack_test.go (idxBuf.Write → WriteString) is included because bytes.Buffer.Write cannot take a const string; it could not be pre-applied on the layer below, where idxV2Magic is still []byte.

Note

Stacked on #26. Top of the stack at time of writing.

Checklist

• gofmt clean
• Every new test mutation-checked: reverting the fix makes it fail
• This layer builds and passes the full race suite on its own, not just at the top of the stack