Tighten Nix source filtering to prevent spurious rebuilds

Only include directories that are ancestors of source files in
allSources.  Previously accepted all directories, causing rebuilds
when any new directory was added to the repo.

Implementation: - Precompute normalized source paths and their ancestor
directories - Filter directories against allowedDirs whitelist -
Normalize paths in file filter for consistency - Keep existing skip
list behavior for _ and .direnv

This is optimization #2 from Phase 2 of the performance plan.

0 files changed, 0 insertions, 0 deletions