Add test coverage for compose's apply-time exclusion filter (untracked nested repository)

Summary

#5611's fix (1daedea01) normalizes six comparison sites so an excluded untracked nested repository actually matches its slash-less gitlink hunk. Five of those are covered by the tests added with it. The sixth — the apply-time hunkFilter rebuilt from the cached snapshot (src/webviews/plus/graph/compose/integration.ts:340-341) — is not, and it is the one site where the change alters behavior rather than only matching: the excluded entry is now genuinely filtered out and left in the working tree instead of being committed.

#5611 called this out explicitly ("The apply-time site (:343) needs its own verification, since changing what the filter matches changes which hunks get committed versus left behind in the working tree"), and it is still unverified.

Why it can't be covered by driving the UI

The compose AI simulator can't reach this path:

• runSimulatedComposeChanges (src/webviews/plus/graph/compose/simulator.ts) replaces generatePlanForGraphDetails entirely, so in simulator mode the plan-generation filter never runs either.
• The bypass deliberately registers no compose-tools cache key, so commitCompose returns "No active compose plan; please regenerate." — there is no fake apply path.

So this needs either a test at the integration seam or a run against a real AI provider.

Suggested coverage

At applyCachedPlan / the commitCompose seam, with a cached plan whose excludedFiles carries a trailing-slash path (nested-repo/) and whose sourceHunks include the slash-less gitlink hunk (nested-repo):

1. The gitlink hunk is absent from what is committed.
2. It survives as an uncommitted leftover in the working tree (the library computes leftovers from the filtered set).
3. The snapshot's diffHash is derived from the same filtered set, so the drift check does not report a false SAFETY_CHECK_FAILED — the failure mode the surrounding comment warns about.
4. A rename is matched on either endpoint (fileName / originalFileName), mirroring the hunkMatchesPath cases already covered elsewhere.

The existing suites to extend: src/webviews/plus/graph/compose/__tests__/integration.test.ts (which already covers the plan-generation filter, moveFilesBetweenCommits and getMaskedHunksForCachedCommit trailing-slash cases).

Notes

Found while verifying #5603, #5604, #5605, #5606 and #5611 on main (779dac1db). Those four are confirmed fixed; #5611 is confirmed at the unit level and its premise confirmed live (the Compose panel shows the same shared scopeFiles row nested-repo U), with only this site outstanding.

Related: #5611, #5603. Filed from the same verification pass: #5629 (the row's name is empty in its tooltip), #5630 (exclusions applied post-diff).