fix(grep): exclude token-bomb dirs from recursive search (#2064)

[maxmilian]

Summary

• Fixes grep -rn fallback causes token *expansion*: execs system grep, descends node_modules, dumps minified files #2064: rtk grep -rn <pat> <dir> descends node_modules and dumps minified vendored code, turning a token reducer into a token expander (~57× the gitignore-aware grep in the report).
• Re-excludes only well-known token-bomb dirs/files, while keeping --no-ignore-vcs so genuinely-searched .gitignore'd files (configs, etc.) are still found.

Target branch is develop per CONTRIBUTING.

Root cause

src/cmds/system/grep_cmd.rs passes --no-ignore-vcs to rg (intentional, to avoid false negatives for .gitignore'd files — comment at the call site). The side effect: rg descends dependency/build dirs like node_modules, emitting megabytes of minified single-line bundles. When rg is absent, the fallback execs system grep -rnHZ (BSD grep on macOS), which is not gitignore-aware and descends node_modules too.

Fix

Wire the existing but previously-unused config.filters.ignore_dirs / ignore_files list (node_modules, target, .venv, vendor, *.min.js, *.lock, …) into:

• the rg invocation as --glob '!<pat>', and
• the system-grep fallback as --exclude-dir=<dir> / --exclude=<file>.

Correctness (no false negatives)

• rg honors an explicitly-given path inside an excluded dir, so rtk grep foo node_modules/pkg works.
• grep --exclude-dir does not honor that (verified on BSD grep). To keep both paths consistent and never drop a result the user asked for on purpose, exclusions are skipped entirely when the search path itself targets an ignored dir (path_targets_ignored_dir). The check is path-component-anchored, so my-node_modules-helper is unaffected.

Tests

• cargo fmt --all --check && cargo clippy --all-targets && cargo test — all green (1986 passed).
• New unit tests (red→green): test_ignore_globs_exclude_node_modules, test_ignore_globs_empty_config_yields_nothing, test_ignore_grep_excludes_for_fallback, test_path_targets_ignored_dir.
• Manual before/after on a frontend-style repo with node_modules:
  • rtk grep define . → 10,517 chars → 104 chars (node_modules no longer dumped).
  • rtk grep define node_modules/pkg-a → still returns the matches (explicit path honored).

Token-savings ≥60% checklist item is N/A: this is a correctness/expansion fix on the existing grep filter, not a new compression filter — and it strictly reduces output. Cites design principle #1 (Correctness over Token Savings).

Scope

• Intentionally keeps --no-ignore-vcs (false-negative-avoidance preserved for non-token-bomb gitignore'd files).
• Reuses the existing FilterConfig ignore list rather than inventing a new hard-coded set, so users can already customize it via config.
• No shell-string interpolation; all args go through Command::arg.

Follow-up

• Related fix(grep): accept -r/--recursive flag so grep -rn routes through RTK filter (#880) #1219 / [grep] reduce fallbacks for common flag combinations (-rn, -l, -A/-B/-C, -E, -o, -c) #1833 frame the -rn fallback as a coverage/measurement gap; this PR addresses the severity (expansion) side and is independent of those.