Feature: portable index output/import for isolated exact-commit builds

Problem

Governed consumers need to index an immutable commit in an isolated checkout, validate the complete result, and only then replace the canonical index. This prevents dirty integration-worktree bytes from masquerading as the target commit and keeps a failed build away from the last readable index.

GitNexus 1.6.10's atomic full-rebuild swap and opt-in atomic incremental are valuable progress. However, the public contract still appears bound to <repo>/.gitnexus, and the Windows path may fall back to in-place construction. That does not let an orchestrator build in a detached checkout and promote/import the result for the canonical repository identity.

Requested capability

Please expose one supported provider contract:

1. analyze --output <path> plus a path-independent repository identity manifest; or
2. index export <path> / index import <path> for a complete, closed index.

The contract should:

• bind source repository identity and the exact indexed commit;
• keep --index-only semantics and avoid consumer instruction/config writes;
• avoid changing the canonical registry/index until promotion;
• validate format, completeness, readability, and functional open before promotion;
• atomically promote on the same volume, with no in-place fallback when atomic mode is required;
• leave the prior canonical index byte-identical after any build/validation/promotion failure;
• report whether full or incremental construction actually ran;
• work on Windows as a fail-closed guarantee, not best effort.

Acceptance sketch

• Build from a detached clean checkout while the canonical integration checkout is dirty.
• Prove the output binds the requested commit, not working-tree overlays.
• Kill/fail construction before promotion; the old index remains readable and byte-identical.
• Promote once; existing readers reopen onto the new complete index.
• Reject wrong repository identity, wrong commit, incompatible format, cross-volume promotion, and a Windows rename failure without falling back to in-place mutation.

If 1.6.10 already has a supported seam for this, documentation pointing to that API would be enough. The request is intentionally about provider capability; consumers should not copy .gitnexus directories and hope path identity is feeling cooperative that day.