feat: sparse checkout deny-all-by-default (modified cone pattern)

[Copilot]

Sparse checkout pattern management is notoriously error-prone because users must understand git's last-match-wins gitignore semantics. This implements the "modified cone pattern" model: !/* is automatically prepended to every sparse-checkout file, so users only declare what they want — no manual negation or ordering knowledge required.

Core changes

• SPARSE_DENY_ALL constant ("!/*") — single source of truth, module-level in git_manager.rs
• build_deny_all_sparse_patterns() — normalizes patterns before writing:
  • Strips blank entries (handles --sparse-paths "")
  • Prepends !/* unless already present (no duplication)
• configure_sparse_checkout() — calls the normalizer; all sparse-checkout files now start with !/*
• check_sparse_checkout_status() — filters !/* from both sides before comparison so status reflects only user-specified patterns

Config / docs

• sample_config/submod.toml sparse_paths docs updated to show what git patterns are actually written:

sparse_paths = ["src/", "include/", "*.md"]
# Writes to sparse-checkout file:
# !/*        ← deny all (added automatically)
# src/
# include/
# *.md

Tests

Two new integration tests:

• test_sparse_checkout_deny_all_prefix — asserts !/* is the first line and only declared dirs exist in the working tree
• test_sparse_checkout_deny_all_not_duplicated — asserts !/* appears exactly once when the user already supplies it

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• invalid-host
  • Triggering command: /home/REDACTED/work/submod/submod/target/debug/submod /home/REDACTED/work/submod/submod/target/debug/submod add git@invalid-host:user/repo.git --name invalid-test --path lib/invalid (dns block)
  • Triggering command: /usr/bin/ssh /usr/bin/ssh -o SendEnv=GIT_PROTOCOL git@invalid-host git-upload-pack 'user/repo.git' -b main /usr/bin/git /tmp/.tmpc6QsfH/git git de/node/bin/git git subm�� deinit --all tnet/tools/git -b main t gettext (dns block)
  • Triggering command: /home/REDACTED/work/submod/submod/target/debug/submod /home/REDACTED/work/submod/submod/target/debug/submod add git@invalid-host:user/repo.git --name invalid-test --path lib/invalid mod README.md git nfig/composer/veuser.email mod add . it k/_temp/ghcca-node/node/bin/git lib/sparse-reinigit read-tree p/bin/git git (dns block)
• nonexistent.domain.invalid
  • Triggering command: /home/REDACTED/work/submod/submod/target/debug/submod /home/REDACTED/work/submod/submod/target/debug/submod add REDACTED --name invalid-test --path lib/invalid mod /opt/pipx_bin/gigit (dns block)
  • Triggering command: /usr/lib/git-core/git-remote-http /usr/lib/git-core/git-remote-http origin REDACTED git rev-�� rk git ck -b main nfig/composer/veadd git t user.email large_repo.git ndor/bin/git file:///tmp/.tmpgit --name k/_temp/ghcca-no--cached sed (dns block)
  • Triggering command: /home/REDACTED/work/submod/submod/target/debug/submod /home/REDACTED/work/submod/submod/target/debug/submod add REDACTED --name invalid-test --path lib/invalid ndor/bin/git --pack_header=2,git -q e/git git conf�� user.email test@example.com k/_temp/ghcca-node/node/bin/git --bare tname) e/git sed (dns block)
• nonexistent.invalid.domain.test
  • Triggering command: /home/REDACTED/work/submod/submod/target/debug/submod /home/REDACTED/work/submod/submod/target/debug/submod add REDACTED --name timeout-test --path lib/timeout ndor/bin/git /tmp/.tmpeOtKBD/git t p/bin/git git conf�� user.name (dns block)
  • Triggering command: /usr/lib/git-core/git-remote-http /usr/lib/git-core/git-remote-http origin REDACTED git chec�� -b main e (dns block)
  • Triggering command: /home/REDACTED/work/submod/submod/target/debug/submod /home/REDACTED/work/submod/submod/target/debug/submod add REDACTED --name timeout-test --path lib/timeout /home/REDACTED/.dotnet/tools/git t git t git clea�� large_repo_work /bin/sh it low git-receive-packcheckout de/node/bin/git git (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)