feat(structure): commits carry a map of what they contain (STR-02b)

[kaanozhan]

Implements spec .frame/specs/str-02b-commit-map-publication/ (tasks T01–T06). Per-task detail and deviations are in its outcome.md.

Why — a leak

The pre-commit hook staged the on-disk STRUCTURE.json, which STR-01/STR-02 keep as the working-tree view, untracked files included. Verified in a scratch repository: after committing an unrelated change, the committed map contained an untracked private-notes.md with its first heading as the description. STR-02 made this continuous.

What changes

• update-structure.js --staged (scripts/structure-commit.js): builds the commit's map from the effective index (GIT_INDEX_FILE, pathspec commits, linked worktrees, unborn HEAD) and publishes it into the index only. The index is read through ls-files -s -z / cat-file --batch as a small read-only fs, so STR-01 discovery and generation run unchanged. Publication rechecks the index hash and uses update-index --cacheinfo under Git's own lock; a map path that is ignored or under local sharing is never force-added. The working map is never written. Results go to .frame/runtime/structure/commit.json.
• Hook: the snippet runs --staged and never git add. The hooks directory is resolved with Git (linked worktrees used to fail). An unmodified earlier Frame template is upgraded on init and on open, recognized by SHA-256 of every template ever shipped. Husky, lefthook, core.hooksPath folders and edited hooks are never touched — they get instructions.
• Visibility: check-freshness reports hooks still running the old --changed + git add snippet, and commits whose map could not be staged.
• This repository: .githooks/pre-commit now runs --staged on every commit; this PR's last commit already used it.

Decisions (asked during planning)

• The working-tree view stays in .frame/STRUCTURE.json (agents read it directly). Accepted costs, documented: git status shows the map as modified while the two views differ, and --no-verify skips the hook.
• Only unmodified Frame hooks are auto-upgraded.
• Policy comes from the staged config or generator defaults; curation from the working copy (it lives in the gitignored .frame/bin/).

Also note

• A one-line change in scripts/structure-snapshot.js (outside the planned footprint) lets the extraction cache parse from the index, so identical content is not re-extracted across views.
• The hook template's header promise changed from "Frame will not overwrite it" to "while unmodified, Frame keeps it up to date".

Verification

• npm test: 1089/1089.
• An end-to-end test commits through a real installed hook: no untracked or unstaged content reaches the committed map, including a pathspec commit; the working view is untouched.