test(git-utils): verify snapshot object isolation semantically

[andrei-hasna]

Summary

• replace the platform-fragile raw .git/objects file count with exact snapshot tree/blob OID checks
• verify snapshot-only objects resolve with the isolated object directory and repository alternates
• verify the same OIDs do not resolve from the repository object database alone
• preserve automatic snapshot clean/process filter neutralization unchanged

Failure analysis

The macOS failure in run 30358028410, job 90280133780 reported the raw count as left=4/right=3. That count includes administrative files under .git/objects and cannot identify a leaked Git object. Manual OID/type/location inspection showed the replacement tree and tracked/untracked blobs in the isolated object directory only.

Verification

• focused semantic test: 10 consecutive passes
• just test-fast -p codex-git-utils: 32 passed
• just test -p codex-git-utils: 32 passed
• Bazel git-utils unit target: passed
• targeted and full workspace argument-comment lint: passed
• just fix -p codex-git-utils: passed
• just fmt: passed
• staged and origin/main..HEAD gitleaks scans: passed
• exact-head Blacksmith Testbox: 30365214792
• exact-head full Rust/macOS proof: 30365235002

Todos: af74aa0f-d259-4275-bcfa-36e737a1b78c
Parent: 7a9ec0db-f762-4276-8fc9-d6bca3954930

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}