fix/review-findings-batch-1: Batch-1 review fixes — glob alignment, DELETE diffs, locale, shallow-clone msg, DX

[vedanthvdev]

Context

Post-v1.9.15 in-depth review across four lenses (correctness,
reliability, security, adversarial) surfaced a batch of issues. This
PR applies every tier-1 finding with a targeted test so the regression
cannot re-enter silently. The tier-2 findings (mostly wording and log
tone) will land in a follow-up.

The two correctness fixes that could silently reduce coverage

outOfScope*Dirs glob alignment

PathToClassMapper (diff-side) honoured "api-test/**" but
ProjectIndex (on-disk) treated the same string as a literal prefix.
A mixed diff — one production file + a refactor under api-test/ —
bucketed the api-test file correctly yet still dispatched tests
discovered under api-test/src/test/java. This is the exact hole the
v1.9.14 --explain hint was introduced to warn about, but the fix
itself never landed.

Both sides now delegate to a shared OutOfScopeMatchers utility,
with a regression test that exercises literal and glob shapes against
identical on-disk layouts and asserts they produce the same dispatch
map.

git rm-only MRs were silently skipping all tests

DiffEntry.DELETE's newPath is /dev/null and the detector
only recorded newPath, so a pure-rm MR produced an empty diff and
routed the whole change through EMPTY_DIFF → SKIPPED under
local/ci mode. Now DELETE entries surface through their old
path, the ignore/out-of-scope rules apply, and deleted production
classes reach the transitive strategy like any other change. The
engine's existing missing-file filter still drops FQNs whose backing
test file is gone, so surfacing deletions never asks Gradle to run a
missing test.

Reliability hardening

• InvalidPathException (NUL bytes, Linux-committed foo:bar.md
  on Windows, reserved device names) now caught in isIgnored and
  the glob matcher. Before, the unhandled exception killed the whole
  affectedTest task with a stack trace; now the offending file
  falls through to the unmapped bucket and the safety net escalates
  normally.
• GitChangeDetector translates JGit's MissingObjectException
  into a targeted message naming the likely cause (shallow clone in
  CI that doesn't know the base ref).
• Malformed globs now fail at config-time with an
  IllegalStateException naming the config key, list index, and
  offending pattern, instead of surfacing a raw
  PatternSyntaxException from several engine frames deep.
• parseMode / parseAction / isWindows pinned to
  Locale.ROOT so Turkish-locale JVMs don't turn mode = "ci"
  into Unknown affectedTests.mode 'ci'.

DX / defense-in-depth

• FQN shape validated before passing to Gradle's --tests argv.
  Discovered strings that aren't Java-shaped identifiers are logged
  as warnings and skipped.
• ImplementationStrategy now recognises the DefaultFooService
  prefix shape, not only the FooServiceImpl suffix — matching the
  shipped implementationNaming = ["Impl", "Default"].
• Per-FQN dispatch lines demoted from lifecycle to info. Each
  MR now gets one lifecycle summary per Gradle task
  (:api:test (3 test classes)); individual FQNs print only under
  --info. A 200-class MR no longer buries the outcome line under
  200 dispatch lines.

Documentation

• Mode Javadoc re-aligned with the mode-defaults table in the
  design doc.
• Situation Javadoc cross-reference for
  ALL_FILES_OUT_OF_SCOPE fixed.
• TransitiveStrategy and AffectedTestsExtension now document
  the actual transitiveDepth default of 4.

Test plan

• ./gradlew check green locally (core + gradle plugin +
  functional tests).
• New OutOfScopeMatchersTest covers literal/glob/mixed
  entries, blank-and-null quietly dropped, malformed glob fails with
  config-key and index, and NUL-byte path fails closed.
• New ProjectIndexTest asserts literal-form and glob-form
  produce the same dispatch map for identical on-disk layouts.
• GitChangeDetectorTest extended with
  detectsDeletedFilesByOldPath exercising a real git rm +
  commit cycle.
• ImplementationStrategyTest extended with
  findsTestForDefaultPrefixedImplementation forcing the naming-
  convention branch to do the work alone (no implements clause
  to let the AST branch rescue it).
• New AffectedTestTaskFqnValidationTest covers accept-paths
  and the shell-metachar / whitespace / hyphen / leading-and-trailing-
  dot reject paths.
• New AffectedTestTaskLocaleTest reproduces the original
  JDK-locale bug by flipping Locale.setDefault to Turkish before
  asserting parse correctness.
• Post-merge verification on security-service (the
  pilot adopter) once the resulting release is on the Gradle Plugin
  Portal. No behaviour change for config that already worked; the
  fixes only close silent-coverage-loss paths.