Add read-only git provider

Implement submodule.Provider with the git CLI so submarine reads real
repositories: `submarine [dir]`, with `--mock` for the built-in data.

- Tree reads .gitmodules recursively; Status derives presence, checkout,
  worktree, staged pin, pushed state and pin -> ref resolution from local
  git commands only (no network).
- Concurrent Status calls are bounded by runtime.NumCPU().
- scripts/make-fixture.sh builds a superproject covering every state; the
  integration tests run against it.
- theme.Ago shows "never" for a zero time.
- Docs updated; decisions D14-D16 added.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ux-guide.md

@@ -72,7 +72,9 @@ indent ▸ name [n]   status          ref             delta
 `path  branch ↑↓ · n submodules · <count> <issue>… · n pin staged · n loading · fetched <age>`
 
 Issue counts are ordered by severity (unpushed, conflict, missing, off pin,
-changed), each in its level color. Zero counts are omitted.
+changed), each in its level color. Zero counts are omitted. `<age>` is
+`never` if the superproject has never been fetched; a detached superproject
+shows `(detached)` as its branch.
 
 ## Colors