fix(checkpoint): exclude protected dirs from first-checkpoint snapshot

The first checkpoint of a session collected changed files via a raw git status parse in collectChangedFiles that only skipped .entire/ (IsInfrastructurePath). Agent-declared protected dirs/files — built-in (.claude) and external protocol-v1 plugins (protected_dirs) — were captured into the shadow-branch tree on session start, unlike the session-tracking and rewind paths which already honor them.

Add isProtectedCheckpointPath, mirroring shouldIgnoreSessionTrackingPath (the two can't share code: cli imports checkpoint), and apply it at the three filter sites in collectChangedFiles.

Make path matching OS-based so case-insensitive filesystems exclude correctly: add paths.CaseInsensitiveFS (windows/darwin), paths.Equal, and fold case in IsSubpath on those platforms. On case-sensitive Linux the behavior is unchanged. Route protected-file equality in state.go and the new checkpoint helper through paths.Equal.

Regression tests: checkpoint first-checkpoint path (built-in + external plugin protected dir/file) and OS-aware paths unit tests.