Add read-only git provider

Implement submodule.Provider with the git CLI so submarine reads real
repositories: `submarine [dir]`, with `--mock` for the built-in data.

- Tree reads .gitmodules recursively; Status derives presence, checkout,
  worktree, staged pin, pushed state and pin -> ref resolution from local
  git commands only (no network).
- Concurrent Status calls are bounded by runtime.NumCPU().
- scripts/make-fixture.sh builds a superproject covering every state; the
  integration tests run against it.
- theme.Ago shows "never" for a zero time.
- Docs updated; decisions D14-D16 added.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/README.md

@@ -17,13 +17,14 @@ bare commit hash.
 
 ## Status
 
-**Prototype.** The UI is complete for browsing and runs on mock data
-(`internal/submodule/mock`). There is no git backend yet, and actions
-(`u`, `b`, `f`, `/`, `!`) only show a "not implemented" message.
+**Prototype.** The UI is complete for browsing. It reads real repositories
+through a read-only git provider (`internal/submodule/git`):
+`submarine [dir]`. `submarine --mock` shows the built-in mock data
+(`internal/submodule/mock`). Actions (`u`, `b`, `f`, `/`, `!`) only show a
+"not implemented" message.
 
 Next steps, roughly in order:
 
-1. Git provider implementing `submodule.Provider` (read-only).
-2. Actions: fetch, checkout pin (`submodule update`), bump pin to tip, init.
-3. Filter (`/`) and "problems only" (`!`) views.
-4. Refresh after actions and on demand.
+1. Actions: fetch, checkout pin (`submodule update`), bump pin to tip, init.
+2. Filter (`/`) and "problems only" (`!`) views.
+3. Refresh after actions and on demand.