Skip hidden sources and report unexpected characters with locations

[bradcypert]

Building a project now skips dot-prefixed files and directories at the project root, inside modules, and in dependencies. AppleDouble companions such as ._main.plum and sources under .git no longer enter compilation; explicitly named hidden source files still work.

Unexpected-character diagnostics include the source path, line, column, and caret. Controls and non-ASCII characters use Unicode codes such as U+0000; source-line controls render visibly so NUL cannot truncate the diagnostic. File-aware lexing also covers formatting and span extraction.

Added CLI regressions for project/dependency discovery, explicit hidden files, and exact diagnostics for NUL, DEL, C1 controls, invisible Unicode, emoji, and printable punctuation, including UTF-8 column counting. Rebuilt sh.real.

Validation:

• Full pre-commit suite: 28 of 29 harnesses passed.
• 94 CLI checks, 182 corpus fixtures, 109 parser/token goldens, 370 lossless round trips, and 365 formatting checks passed.
• Compiler fixed point, self-sufficiency, and seed bootstrap passed.
• cross-check reports five existing failures: four missing TLS-header checks and the i686 refusal assertion. Reproduced all five using the unchanged origin/main compiler.

Self-review completed before submission: checked every source-discovery walker, diagnostic path propagation, Unicode/control rendering, explicit-input behavior, callers, and final diff.

Closes #58