fix(dogfood): enforce workspace.include in walker (allow-list semantics)

config.workspace.include was completely ignored by the walker — connector.rs
log_scope_include_warning literally said "handled by extractor router" but
no extractor router exists. Dogfooding (PR #142 1B + multi-root corpus
kebab-docs + httpx + zod + lodash) showed user-set include of code+md still
ingested 84 .png + 8 .pdf files.

Fix: walker treats scope.include as an allow-list — empty Vec preserves
backward-compat (all files pass), non-empty requires file path to match at
least one pattern (AND with the existing exclude rules). Removed the
misleading debug log.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/kebab-source-fs/src/connector.rs

@@ -86,7 +86,7 @@ impl FsSourceConnector {
         excludes.extend(scope.exclude.iter().cloned());
         let kbignore = read_kbignore(&root)?;
 
-        let overrides = build_overrides(&root, &excludes, &kbignore)?;
+        let overrides = build_overrides(&root, &excludes, &kbignore, &scope.include)?;
         Ok((root, overrides))
     }
 
@@ -103,8 +103,6 @@ impl FsSourceConnector {
     ) -> Result<(Vec<RawAsset>, FsScanSkips)> {
         let (root, overrides) = self.resolve_scan_params(scope)?;
 
-        log_scope_include_warning(scope);
-
         let (files, skipped_entries) = walk_files_with_skips(&root, &overrides)?;
 
         // Accumulate per-category skip counts and sample paths.
@@ -284,14 +282,6 @@ fn build_assets(
     Ok(assets)
 }
 
-fn log_scope_include_warning(scope: &SourceScope) {
-    if !scope.include.is_empty() {
-        tracing::debug!(
-            count = scope.include.len(),
-            "FsSourceConnector ignores scope.include — handled by extractor router"
-        );
-    }
-}
 
 impl SourceConnector for FsSourceConnector {
     fn scan(&self, scope: &SourceScope) -> Result<Vec<RawAsset>> {