fix: block ignored resource artifacts in hashes

[zzgosh]

Summary

• Block ignored, untracked files inside resource paths before computing local tree hashes, preventing machine-local artifacts from polluting lock metadata.
• Keep tracked ignored files supported via git add -f, preserving the existing forced tree-hash behavior for intentional resource content.
• Document the new failure mode and add Codex worker-thread title guidance for cross-model delegation.

Validation

• pnpm agents:test
• pnpm exec tsc --noEmit
• git diff --check
• clean worktree: agents verify OK (16 resources)
• clean worktree: pnpm agents prepare equivalent reported local lock metadata already current