* perf(paths): guard the no-op regex passes and hoist the loop-invariant root
`normalizeRuntimePathForComparison` ran two whole-string regex passes on every
call — `/\/+/g` and `/\/+$/` — that cannot change a path with no doubled slash
and no trailing slash, which is nearly every path. `parseWslUncPath` likewise
folded backslashes and ran an anchored UNC regex over every POSIX path.
Substring/char-code probes skip all of them, and a
`createRelativePathInsideRootResolver` factory (mirroring the existing
`createNormalizedPathInsideOrEqualMatcher`) folds a fan-out's root once instead
of once per candidate. Outputs are unchanged; a seeded 200k-path differential
fuzz against a pre-guard copy proves it.
* perf(paths): drop the root hoist, land the guards alone
The three in-module guards are the whole win: 5000-op batches, CPU time,
median of 9 --- normalize 541 -> 239 ns/op, relativePathInsideRoot
1778 -> 899, isPathInsideOrEqual 1076 -> 572, parseWslUncPath 57 -> 14.
The loop-invariant root hoist added 176 ns/op on top of that (899 -> 723)
at 7 hand-picked call sites, and cost a new exported factory whose
input contract is the opposite of the one next to it, plus a function
substitution in worktree/ownership.ts. Not worth 0.9 ms per storm.
Prod diff: 2 files. New ratchet pins the single-factory surface.
* docs(paths): point the fixture header at the real guards test
