Summary

Fixes a logic/performance issue where status/deploy/import could walk the entire target tree (including $HOME for target: ./) even when unmanaged behavior was not configured.

What changed

• Docs first: clarified that unmanaged/missing candidate discovery is pattern-gated and defaults are manifest-only.
• Planner/runtime fix:
  • Source is still scanned as manifest.
  • Target is now probed by manifest paths by default.
  • Full target walk happens only when unmanaged candidate discovery is actually required by config:
    • status: when on.import.add-unmanaged.include or on.deploy.remove-unmanaged is configured
    • deploy: when on.deploy.remove-unmanaged is configured
    • import: when on.import.add-unmanaged.include is configured
• Added scoped walk pruning for unrelated directories.
• Treat ENOTDIR during target probing as missing path (instead of hard-failing reads).

Why

With a broad sync like:

- target: ./
  source: ./global

and no unmanaged patterns configured, the expected behavior is to evaluate manifest paths only, not scan unrelated paths in $HOME.

Validation

• go test ./...
• go test -tags=contract ./...
• go test -tags=integration ./...
• bash scripts/ci/run-static-checks.sh true
• bash scripts/ci/run-tests.sh contract linux true

Manual check

Reproduced and verified from source build:

• dotfiles-manager status --config ~/.dotfiles/.dotfiles-manager.yaml --log-level debug
• no longer fails with Read failed: /Users/shpoont in the default (no unmanaged patterns) case.