feat(watcher): sync SVN working copies automatically

[lzl51230]

What does this PR do?

SVN working copies can now keep their graph synchronized after local working-copy changes on the watcher's next eligible poll, without requiring a manual full regeneration. The same adaptive cadence and indexing pipeline used by Git remain authoritative: ordinary changes use incremental indexing, while the existing safety threshold can still select a full rebuild.

The watcher observes recursive SVN XML status plus content fingerprints for indexable candidates, pins a trusted system svn executable, and acknowledges a new baseline only after explicit indexing success. Failed or busy updates remain pending for retry, Git keeps precedence in mixed roots, and successful background publication invalidates cached MCP stores on the request thread before the next query. Windows probes use isolated direct-argv stdout capture so MSYS2 paths and filename metacharacters never pass through cmd.exe, while retaining the existing restricted handle-inheritance model.

Decision	Behavior
Source of truth	Current on-disk working-copy state, including eligible versioned and unversioned files
Scheduling	Existing completion-relative adaptive watcher interval; no SVN-specific setting
Pipeline routing	Existing incremental path with the existing full-rebuild safety fallback
Failure handling	Preserve the last acknowledged observation and retry later

Session-settled decisions carried from planning: on-disk working-copy authority, SVN-aware polling, existing adaptive timing and pipeline routing, the system SVN CLI prerequisite, and Git precedence (all user-directed); using the fork's main and proceeding before maintainer feedback were carried out under flagged contribution-process concerns.

Validation

• make -f Makefile.cbm test-focused TEST_SUITES='security svn_state watcher integration' (135 passed).
• Production build with -Wall -Wextra -Werror completed successfully.
• make -j2 -f Makefile.cbm lint-ci passed with CI-matched LLVM 20 clang-format plus cppcheck and the NOLINT whitelist.
• scripts/security-audit.sh and the no-skips policy passed.
• Real local SVN fixtures cover repeated tracked edits, unversioned additions, watcher retry behavior, Git/SVN precedence, incremental publication, and the existing full-route fallback.
• Windows-only coverage checks direct argv stdout capture, literal %/& arguments, nonzero exit propagation, MSYS2 path conversion, and an SVN working-copy path containing metacharacters.
• Browser testing was skipped because this PR changes no UI or browser route.

Related and follow-up tracking

Related: #1113

• Related: Rewatch can index a retired project root #1116 - prevent a rewatch from indexing a retired root.
• Related: Windows cached stores can block watcher publication #1117 - make watcher publication refresh cached stores on Windows.
• Related: Supervised index wrapper bypasses its documented gate #1118 - enforce the supervisor gate through the public wrapper.
• Related: Broken SVN external can freeze primary graph updates #1119 - keep primary updates flowing when an SVN external is broken.
• Related: Add SVN operation acceptance coverage #1120 - add explicit svn update and svn commit acceptance coverage.
• Related: Expand SVN status and path-safety test matrix #1121 - expand the SVN parser and path-safety matrix.
• Related: Cover SVN watcher recovery and lifecycle transitions #1122 - cover SVN watcher recovery and lifecycle transitions.
• Related: Enforce SVN fingerprint byte cap during reads #1123 - enforce the fingerprint byte cap during reads.
• Related: Make SVN fingerprint opens race-safe #1124 - make SVN fingerprint file opens race-safe.
• Related: Avoid recursive stack exhaustion in SVN candidate traversal #1125 - avoid recursive stack exhaustion in candidate traversal.
• Related: Detect ABA edits during watcher indexing #1126 - detect ABA edits during watcher indexing.

Checklist

• Every commit is signed off (git commit -s).
• Tests pass locally.
• CI-matched lint passes locally.
• New behavior is covered by focused and integration tests.

---

[DeusData]

Thanks for the substantial implementation work and for documenting the unresolved cases. The exact head cannot be accepted or expanded in place.

Product and supply-chain boundary

This introduces a conditional runtime dependency on a system Apache Subversion executable while the project currently promises a zero-runtime-dependency binary. It also changes .github/workflows/_test.yml so apt, Homebrew, and MSYS2 install Subversion across existing native and TSan jobs. That product/CI decision has not been approved; please do not add further commits around it until maintainers decide whether this dependency belongs at all.

Current correctness and security blockers

1. The validation-then-open fingerprint path has a TOCTOU containment race (Make SVN fingerprint opens race-safe #1124): a symlink, reparse point, special file, or outside-root target can replace the validated path before open.
2. Fingerprint reads do not enforce the byte cap against bytes actually read from a growing file (Enforce SVN fingerprint byte cap during reads #1123).
3. Recursive candidate traversal can exhaust the watcher thread stack (Avoid recursive stack exhaustion in SVN candidate traversal #1125).
4. The SVN subprocess has no bounded timeout/cancellation path, so a stuck client can block polling and shutdown.
5. Observation acknowledgement can bless stale graph state after an A-to-B-to-A edit race (Detect ABA edits during watcher indexing #1126).
6. A snapshotted retired watch can still invoke the callback after root replacement (Rewatch can index a retired project root #1116).
7. Windows publication fails with a pre-warmed cached SQLite handle (Windows cached stores can block watcher publication #1117); the current Windows full-suite failure is therefore a real product failure, not a flake.
8. One broken external can block primary-working-copy updates (Broken SVN external can freeze primary graph updates #1119), contrary to the PR's stated behavior.
9. The recursive status/fingerprint work has no aggregate work budget or large-tree characterization.

Scope and repository hygiene

The PR combines general incremental dump-error propagation, watcher lifetime changes, MCP store invalidation, a new Windows process API, build/CI changes, and the SVN feature. Those need focused prerequisite PRs with their own RED guards. Replace the raw fopen() added in tests/test_integration.c with cbm_fopen(). Remove docs/plans/2026-07-16-001-feat-svn-auto-watch-graph-sync-plan.md; session execution plans and authority assertions are not repository documentation.

The current security review found no credential, hosted-service, telemetry, vendored-code, or data-exfiltration addition. The blocker is the new local executable/CI dependency plus the unresolved containment and lifecycle defects. Maintainers will decide the product direction separately; this head is not mergeable even if the remaining CI job turns green.

[lzl51230]

please do not add further commits around it until maintainers decide whether this dependency belongs at all.

Acknowledged. I have stopped pushing commits to this head and will leave it unchanged while maintainers decide whether a system SVN dependency fits the product and supply-chain boundary.

If that direction is accepted, I will first split the general prerequisites into focused PRs with RED regression guards, then address the full correctness, lifecycle, timeout, work-budget, and repository-hygiene list before returning to the SVN feature. I will not treat a green CI run as making the current head mergeable.