docs(bench): record why the status-record filter depends on the pathspec

The index-2 space test is sound only because git refuses to pair a rename whose
source is outside the pathspec and downgrades it to A, so every bare source
record reaching the filter starts with a watched prefix. Without the pathspec a
source like 'zz a/f.ts' reads as a status record. Fail-closed, but non-obvious
enough that dropping the pathspec later would look safe.

tests/tools/benchmarks/daemon-build-provenance-gate.mjs

@@ -49,8 +49,13 @@ export function assertDaemonBuildProvenance(repoRoot) {
     encoding: 'utf8'
   })
     .split('\0')
-    // -z emits a bare `new\0old\0` pair for R/C; the status record is the one with
-    // the two-column prefix, and the trailing source path carries none.
+    // -z emits a bare `new\0old\0` pair for R/C, so drop the trailing source path:
+    // only the status record has the two-column prefix. This test depends on the
+    // pathspec above -- git refuses to pair a rename whose source is outside it and
+    // downgrades to `A`, so every bare source record still reaching here starts with
+    // a watched prefix and never has a space at index 2. Drop the pathspec and a
+    // source like `zz a/f.ts` would be misread as a status record (fail-closed: it
+    // adds a spurious dirty entry rather than hiding one).
     .filter((record) => record.length > 3 && record[2] === ' ')
     .map((record) => record.slice(3))
   if (dirty.length > 0) {