`[fixed_dirs] extra` does not suppress nested sentinel exclusions

[jag-k]

asimov version: 0.12.0, including current main at b2a6a835b3d86a34504ba46f8b664f5bef954bdb
macOS version: macOS 26.5.2 (25F84)

What happened:

Sentinel matches nested under a directory configured with [fixed_dirs] extra are processed individually before the configured parent directory is excluded.

For a large tool cache this can produce hundreds of redundant tmutil addexclusion calls. Built-in fixed directories do not have this problem: their descendants are filtered before the per-path tmutil loop.

What you expected:

Sentinel matches below any effective fixed directory should be skipped, regardless of whether the fixed directory comes from data/fixed-dirs.tsv or [fixed_dirs] extra. Only the configured parent should be passed to tmutil addexclusion.

Steps to reproduce:

1. Create a sentinel-matched dependency directory inside a custom cache:

   mkdir -p ~/.custom-cache/example/node_modules ~/.config/asimov
   touch ~/.custom-cache/example/package.json

2. Configure the parent as an extra fixed directory:

   [fixed_dirs]
   enabled = true
   extra = ~/.custom-cache

3. Run a stateless preview:

   asimov --dry-run --no-cache

Relevant output:

📦 Processing matches…
- Would exclude: ~/.custom-cache/example/node_modules.

⚙️  Excluding user-configured directories…
- Would exclude: ~/.custom-cache.

The same behavior occurs with enabled = false: extra fixed directories are still excluded as documented, but their nested sentinel matches are not filtered.