repo-fleet-hygiene: one non-repository path under --root aborts the entire audit

[kyle-sexton]

Context: #2597

Problem

A single unreadable or non-repository path discovered beneath a --root aborts the entire audit. Discovery is by definition a walk over directories that are mostly not repositories, so treating "not a Git working tree" as fatal makes --root unusable against any realistic tree.

The skill already specifies per-entry degradation for config-sourced entries — "deleting repositories right after an audit must not abort every subsequent run until the config is edited." Discovery-sourced paths deserve the same treatment and do not get it.

Evidence

Auditing a dev drive with --root "D:/" failed immediately:

Error: not a Git working tree: D://$RECYCLE.BIN/S-1-12-1-1266650682-.../...

$RECYCLE.BIN and System Volume Information exist at the root of every Windows volume, are unreadable, and are never repositories.

Narrowing to --root "D:/repos" --root "D:/worktrees" --root "D:/spike" --root "D:/d" --root "D:/backups" failed again on a different path:

Error: not a Git working tree: D:/repos/github.com/melodic-software/claude-code-proxy

That directory is a real repository in an unusual state (core.bare=true with a populated working tree — see the separate issue for that class), but the outcome is the same: one path stopped a 127-repository audit.

The run only completed after enumerating the working trees by hand and passing 127 explicit --repo arguments — which defeats the purpose of --root.

Proposed change

• A path discovered beneath a --root that is not a Git working tree is skipped silently. It is an ordinary directory, not an error.
• Only an explicitly supplied --repo that is not a working tree remains a hard failure, since the operator named it directly.
• Add a built-in skip list so discovery never descends into paths that are never repositories: $RECYCLE.BIN, System Volume Information, .git, node_modules, .venv, __pycache__, target, bin, obj.
• Add --exclude <glob> and a config fleet.exclude key for machine-specific additions.
• Report skipped-and-unreadable counts in the header so silence is not mistaken for completeness.

Acceptance criteria

• --root pointed at a Windows volume root completes and audits the repositories beneath it.
• A permission-denied or non-repository directory beneath a --root never aborts the run.
• An explicit --repo that is not a working tree still fails, and names the path.
• The header reports how many discovered paths were skipped and how many were unreadable.