Hidden files and folders missing from @ file mentions

Description

Hidden files and folders (dotfiles such as .env, .npmrc, .gitignore, or a file named .hidden.ts) no longer appear in the @ file mention autocomplete. This affects both the CLI TUI and the VS Code extension, because both use the same backend file search.

The regression was introduced by the file-search change that shipped in v1.17.4 (PR #12204) and first reached users in v7.5.0. Before that change, @ mentions listed hidden files and folders.

Expected: typing @ or @hid should offer hidden files and folders, as it did before v7.5.0.

Current behavior

• The default file-search backend was switched to an indexed backend that starts a background file watcher. In non-git directories this backend does not index dotfiles, so they are missing from @ mentions. Inside a git repository it does index dotfiles.
• The non-indexed fallback path scans with hidden files excluded, so dotfiles are also missing whenever the indexed backend is unavailable.

Why this is not a one-line fix

Re-enabling the previous backend reintroduces a background file watcher, which we want to avoid, and it changes result ranking and freshness. Trying to include hidden files in the non-indexed path surfaced several further problems that must be handled together:

1. Empty-query results can drop folders. @ suggestions are assembled by listing files first and folders second, then truncating to a limit. A caller that does not request a specific type can receive only files, so folders become unreachable in the autocomplete for an empty query.
2. Results can go stale. A one-shot scan at startup does not see files created during the session. New files are not mentionable until the session or backend reloads.
3. Cost on large repositories. Matching runs on every keystroke over the full file list, which can be heavy on very large repositories.
4. Secret exposure. Listing dotfiles surfaces credential files (.env, .npmrc, .netrc, .git-credentials, cloud credential files, SSH keys, certificates, and similar) in @ suggestions, which can pull secrets into the model context. Read permissions must gate these files behind an explicit prompt.

Steps to reproduce

1. Open a project folder. Test both a git repository and a non-git folder.
2. Create a hidden file, for example .hidden.ts, and a visible file, for example visible.ts.
3. In the prompt, type @, then @hidden.
4. The hidden file is not offered.

Expected

• Hidden files and folders are offered in @ mentions, in both git and non-git folders.
• No background file watcher is started.
• Newly created files appear without a full reload.
• Folder suggestions remain available for an empty @ query.
• Credential files require an explicit read confirmation.

Notes for resolution

• Choose a search backend that includes hidden files while avoiding a background watcher, and preserve folder results and reasonable freshness.
• Measure performance on large repositories before and after the change.
• Verify the behavior in both the CLI TUI and the VS Code extension.

Environment

• Kilo version: 7.5.0 and later.
• OS: macOS (reproduced). Other platforms are likely affected.