Bug: @ file picker surfaces .git refs/logs entries

Problem

@ file picker suggestions include Git internal reference/log files (for example .git/refs/... and .git/logs/refs/...).

This is confusing because the picker is expected to show project files intended for code context, not VCS internals.

Environment

• Codex Desktop: 26.228.1430 (760)
• Codex CLI: 0.106.0
• OS: macOS 26.3 (25D125)
• Architecture: arm64

Reproduction

1. Open Codex in any Git repository that has local or remote branches.
2. In the prompt input, type @ followed by a partial term matching a branch-like token (for example a feature name segment).
3. Observe suggestions/results.

Actual Behavior

Suggestions include entries under:

• .git/refs/...
• .git/logs/refs/...

Expected Behavior

@ file picker should exclude Git internals and only show relevant workspace files.

Action Plan

• [ ] Confirm whether file picker is bypassing ignore rules for hidden/VCS directories.
• [ ] Ensure .git/** is excluded across CLI, desktop app, and extension for consistent behavior.
• [ ] Add regression tests for @ completion/search with repositories containing refs/logs.

Acceptance Criteria

• [ ] @ suggestions never include .git/** entries.
• [ ] Project files remain searchable as before.
• [ ] Behavior is consistent across Codex surfaces.