GetSourceManifest revision escapes a subdirectory-rooted Code boundary

[AntoineToussaint]

Production evidence

A real Mind headless coding session rooted Codefly at sample/small/go-cli-wordcount. The worktree manifest and every tool/mutation receipt were correctly relative to that boundary (main.go), but the immutable revision manifest returned the entire outer repository because revisionSourceManifest uses git ls-tree --full-tree without a rooted pathspec.

That root mismatch caused two customer-visible failures after the agent made the correct change and all typed tests passed:

• semantic ingestion rejected main.go as absent from the exact source manifest;
• change publication interpreted an unrelated outer-repository path as an unaccepted deletion and failed the session.

Replay reproduces the failure deterministically.

Current-contract requirement

DefaultCodeServer is documented as rooted at SourceDir. Revision and worktree manifests must therefore expose the same path universe and both use paths relative to SourceDir, including when SourceDir is a nested directory inside a larger Git worktree. Project bytes remain inside Codefly.

Acceptance

• A server rooted at a nested tracked directory returns only that directory's revision entries, relative to the server root.
• Root-level behavior, native/content identity modes, symlinks, executables, and gitlinks remain correct.
• The production Mind session no longer sees outer-repository files in semantic or publication evidence.