fix: apply post-v1.9.16 review findings (batch 2)

[vedanthvdev]

Summary

Follow-up pass on the non-blocking findings from the v1.9.16 code review.
Scope is deliberately narrow — doc/behaviour parity plus coverage for
error branches the batch-1 fix relied on without testing.

Changes

Correctness — symmetric DELETE handling across all three diff sources

GitChangeDetector.uncommittedChanges and stagedChanges now surface
DiffEntry.DELETE entries through the old path, the same way
committedChanges has since v1.9.16. v1.9.16 patched the committed
branch only, which was inert under its own committed-only defaults but
re-opened the silent-skip hole the moment any adopter flipped
includeUncommitted or includeStaged back on to iterate on a local
git rm. All three diff sources now share one collectPaths helper so
future bucketing changes can't drift between them again.

Coverage for previously-untested error branches

• GitChangeDetector shallow-clone MissingObjectException — exercised
  via a synthesised .git/refs/heads/ghost pointing at a SHA that isn't
  in the object store. Same state JGit sees inside a shallow clone,
  without needing a real shallow-clone fixture.
• PathToClassMapper.isIgnored InvalidPathException — exercised with
  a NUL byte in the filename (the portable way to make the default
  FileSystem reject a path on any platform).
• Malformed glob in ignorePaths — parity test with the existing
  outOfScope*Dirs error-message regression, locks in the
  key[index]: 'pattern' shape of the IllegalStateException.

All three branches already shipped correct behaviour in v1.9.16; this
PR only adds the coverage that should have been part of that patch.

Docs

• AffectedTestTask.getTransitiveDepth() Javadoc now says Default: 4
  with the same rationale TransitiveStrategy and
  AffectedTestsExtension got in v1.9.16 — this was the third site the
  previous pass missed.
• OutOfScopeMatchers class Javadoc drops unnecessary **
  escapes for ** (the Javadoc comment-terminator is */, not **),
  and adds a one-liner explaining why the opening-brace escape
  { still has to stay.
• hasGlobMetachar now documents why only the opening forms [ and
  { count as glob indicators — an unbalanced ] or } in a literal
  directory name is far more likely than the user meaning "glob", and
  promoting it to glob compilation would turn typo-in-literal into a
  build-breaking glob syntax error.
• AffectedTestTask.JAVA_FQN now documents the intentional
  non-validation of Java reserved words: the discovery strategies read
  real filenames, so an FQN shaped like a keyword only arrives
  adversarially and Gradle's --tests matcher reports "no tests found"
  for it, never a compile failure.

Verification

• ./gradlew check — green
• ./gradlew javadoc — clean, no new warnings
• All 5 new tests ran and passed:
  • GitChangeDetectorTest#detectsUncommittedDeletesByOldPath
  • GitChangeDetectorTest#detectsStagedDeletesByOldPath
  • GitChangeDetectorTest#explainsShallowCloneWhenBaseObjectMissing
  • PathToClassMapperTest#unparseablePathNameDoesNotCrashIsIgnored
  • PathToClassMapperTest#malformedIgnorePathsGlobFailsWithHelpfulMessage

Test plan

• ./gradlew check green locally
• Javadoc builds clean
• CI green
• Release workflow cuts a patch version
• security-service pilot bumps to the new version and keeps passing