Fix quick scans for working tree and non-ASCII paths

[leisen6688]

Summary

• include tracked working-tree changes and untracked files in quick scans
• read NUL-delimited Git paths so non-ASCII and special filenames resolve correctly
• keep paths relative to nested workspaces and invalidate both sides of renames
• bump engine and plugin metadata to 0.3.2 as required by the repository versioning contract

Why

quick_scan() compared the last refresh SHA only with HEAD, so staged and unstaged edits were silently missed. Git also quoted non-ASCII filenames in line-delimited output, causing those paths to be joined to files that do not exist. Nested workspaces could receive repository-root-relative paths, and rename detection hid the old path.

Validation

• python -X utf8 scripts/check_repo_contract.py
• python -X utf8 -m pytest engine/tests/test_hub_scanner.py -q — 32 passed
• python -X utf8 -m pytest engine/tests cli/tests -q -k "not test_mcp_log_permissions_are_private" — 280 passed, 1 deselected

The unfiltered Windows run reached 280 passed with one existing POSIX permission-mode assertion failing because Windows does not expose Unix chmod bits.