[TASK] Exclusion split (basename + pathPrefix with canonicalize)

[kirich1409]

Context

Walker descend checks: canonicalize(child) → basename in excludedBasenames → canonical.startsWith any excludedPathPrefixes → GlobalDenyList. .git/ is a marker, not descended.

Acceptance criteria

• AC-20 passes (symlink ~/Projects/evil → ~/Library/ not descended).
• Composable defaults exposed.

Files to touch (estimate)

best-effort estimate; agent refines during implementation

Implementation notes

n/a

Dependencies

• Blocked by [TASK] FastWalker protocol + default exclusion constants #57

Safety checklist

See .github/ISSUE_TEMPLATE/task.yml — tick applicable invariants in the issue if any destructive path is touched.

Definition of Done

• Acceptance criteria satisfied and verifiable
• Tests added or updated
• No build / lint / test regressions
• Self-review against research-report invariants
• Code review approved