fix PR #358 review findings

[sgathrid]

Issues identified

• Top-level detection uses scan_root, which drops src/, build/ etc. on subdirectory scans — relative paths never match git_root.
• Builtin checks use absolute path components — a checkout under .../vendor/... causes everything to be ignored.
• Fingerprint/freshness use a None checker — ignored files get a dirty hash or report false staleness.
• Header detection misses auto-generated / GENERATED CODE variants; explicit files are handled inconsistently; subdirectory scans bypass the root .toposignore.

Fixes

• Anchor top-level detection to the git root (single source of truth), falling back to scan root when there's no git repo.
• Check builtin/topos/git ignores using scan-relative or git-relative paths — no more per-file canonicalization.
• Fingerprint/freshness now use the same checker as evaluate, so results stay consistent.
• Normalize -/_/' variants and add missing header triggers; explicit files intentionally bypass ignore rules; load .toposignore from both scan root and git root.