Stream large -z git output instead of buffering it against the cap

[tyrielv]

Summary

Follow-up to #2048. That PR bounded the previously-unbounded git stdout/stderr capture and, for the two commands whose full result is correctness-critical, added a large stdout cap plus fail-safe valves if the cap was ever exceeded. This PR removes that truncation exposure entirely by streaming those commands' output instead of buffering it.

• DiffCachedNameStatus (diff --cached --name-status -z) feeds every staged path into ModifiedPaths.
• StatusPorcelain (status --porcelain -z) drives the sparse dirty check.

Both use -z (NUL-delimited), so line-based streaming can't chunk them — git delivers the whole blob as a single "line."

Change

Add a NUL-delimited streaming mode to InvokeGitImpl: a new parseStdOutToken callback reads stdout synchronously and splits on \0, invoking the callback once per record as it arrives. stderr stays async (BeginErrorReadLine), so the synchronous stdout read is deadlock-safe ("one sync, one async"). Only one record is held in memory, so an arbitrarily large result streams with no buffering, truncation, or OOM. It keeps git's robust -z format (no path-unquoting) and is guarded to timeoutMs == -1 and mutual exclusion with parseStdOutLine.

DiffCachedNameStatus and StatusPorcelain now stream tokens; their callers drive small status/path state machines. This removes the interim fail-safe valves from #2048 (there's no longer a partial result to guard against) and the dead -z string parsers (GetPathsNotCoveredBySparseFolders, GetNextGitPath). Result.OutputTruncated/ErrorsTruncated remain for the still-buffered commands (stderr is still bounded), but the two converted commands can no longer trip OutputTruncated.

Tests

• ReadStdOutTokens: NUL splitting, empty input, embedded empty records, a trailing record without a NUL, and a record spanning the 8KB read buffer.
• DiffCachedNameStatus/StatusPorcelain stream records through the mock.
• Replaces the removed GetNextGitPath test; PathCoveredBySparseFolders tests unchanged.

Full unit suite: 889 passed, 0 failed (11 pre-existing native-hook skips).

[Keith Klein (KeithIsSleeping)]

Before this PR, the method parsed and applied Result.Output only after result.ExitCodeIsSuccess. With streaming, the callback runs while git is still executing and before the final exit code is known.

We should be careful mutating ModifiedPaths before git diff succeeds

[tyrielv]

Good catch — fixed. The streaming path now buffers the parsed (status, path) records and only applies them to ModifiedPaths after git diff --cached exits successfully, so a mid-stream failure can't leave a partial mutation behind (matching the pre-PR "apply only on success" behavior). Holding the parsed records as small strings still avoids the single large-array allocation that caused the original OOM. Also note streaming is now off by default (gvfs.stream-git-status-output), so this path only runs once enabled.