fix(index): keep the snapshot store out of the index-repo namespace

Verifying the guard on a real refresh showed it working — three index trees
archived, 3.2 MB, snapshot ids being the upstream commit shas — and also showed
where I had put the store: `<home>/registry/data/.index-snapshots`, i.e. inside
the directory that IS the index-repo namespace.

Everything that enumerates index repos does it by listing subdirectories of
`data/`. Fetcher::sorted_index_dirs returns every one of them with no filter,
and xlings walks the same tree. The store was being handed to those scanners as
if it were an index.

It happens to be harmless today: the store has no `pkgs/`, so a descriptor
lookup stats a path that does not exist and moves on. That is a property of
someone else's loop, not of this design, and it would stop holding the moment
the store's internal layout changed or a scanner started matching on something
other than `pkgs/`.

The store is now a sibling of the data root — `<home>/registry/index-snapshots`
— where no index scanner can reach it. The defensive skip in `index_dirs` stays:
that loop decides what gets archived, and an archive of the archive is the one
mistake that would grow without bound.

Verified on a real refresh: `data/` clean, store in the new location, same
3.2 MB. unit 55/55, e2e 176 passed / 0 failed.

Author: speak-agent

src/pm/index_snapshot.cppm

@@ -63,7 +63,17 @@ export namespace mcpp::pm::index_snapshot {
 // mcpp index has changed its floor 6 times in its entire life).
 inline constexpr std::size_t kKeepPerIndex = 5;
 
-// <dataRoot>/.index-snapshots/<index-dir-name>/<snapshot-id>/
+// The snapshot store is a SIBLING of the index data root, never inside it:
+//
+//     <dataRoot>/..                 index-snapshots/<index-dir-name>/<snapshot-id>/
+//
+// Everything that enumerates index repos does it by listing directories under
+// `data/` (mcpp's own Fetcher::sorted_index_dirs takes every subdirectory, and
+// xlings walks the same tree). A snapshot store living there would be handed to
+// those scanners as if it were an index. Today that happens to be harmless —
+// the store has no `pkgs/` so lookups miss and move on — but "harmless because
+// of a detail of someone else's loop" is not a property worth depending on,
+// and it costs nothing to put the store where no index scanner can reach it.
 std::filesystem::path snapshots_root(const std::filesystem::path& dataRoot);
 std::filesystem::path snapshot_dir(const std::filesystem::path& dataRoot,
                                    const std::filesystem::path& indexDir);
@@ -187,7 +197,11 @@ std::string sanitize_component(std::string s) {
 } // namespace
 
 std::filesystem::path snapshots_root(const std::filesystem::path& dataRoot) {
-    return dataRoot / ".index-snapshots";
+    auto parent = dataRoot.parent_path();
+    // Degenerate path (relative "data", or a root) — fall back to staying put
+    // rather than climbing out of the home directory.
+    if (parent.empty()) return dataRoot / ".index-snapshots";
+    return parent / "index-snapshots";
 }
 
 std::filesystem::path snapshot_dir(const std::filesystem::path& dataRoot,
@@ -212,7 +226,10 @@ index_dirs(const std::filesystem::path& dataRoot) {
     for (auto& e : std::filesystem::directory_iterator(dataRoot, ec)) {
         if (ec) break;
         if (!e.is_directory()) continue;
-        // The snapshots store lives under the same root; never snapshot it.
+        // The store is a sibling of dataRoot (see snapshots_root), so it
+        // should never appear here. Skipped anyway: this loop decides what
+        // gets archived, and an archive of the archive is the one mistake
+        // that would grow without bound.
         if (e.path().filename() == ".index-snapshots") continue;
         std::error_code pec;
         if (!std::filesystem::is_directory(e.path() / "pkgs", pec)) continue;