Reintegrate the updated pygix branch and security-audit base

Pin packaged Gitoxide dependencies to public base 1d7bac742f and refresh the
three source-preserving vendor patches from pygix HEAD e4d2b313b8. Keep local
development selection, unconditional parallelism, pure Rust dependencies,
and packaged builds independent of the developer checkout.

Propagate the new fallible native path/configuration/reference/shallow/worktree
results and move interruptible reads to gix::utils. Extend pathspec checks and
update the upstream provenance, coverage baseline, changelog, and validation
record. Preserve the existing v0.1.0 tag and upstream branch.

Validation: 105 Python integration tests pass in local and packaged modes on
CPython 3.14.7 and free-threaded 3.14.7 with the GIL disabled. SHA-1-only and
SHA-256-only discovery pass with expected capability skips. Default and reduced
clippy pass with warnings denied; seven Rust tests and nine helper checks pass.
Builds use disabled C/C++ compilers. An independently built sdist ABI3 macOS
wheel passes installed tests, content validation, and public provenance checks.
No pushes, upstream edits, publication, or remote CI were performed.

Author: codex

CHANGELOG.md

@@ -13,6 +13,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
    `GIXPYTHON_GITOXIDE_PATH` or `--gitoxide-path`, using a separate development
    lockfile. `--packaged` forces release dependencies. Local builds report checkout HEAD.
 
+### Other
+
+ - Reintegrate the updated Gitoxide `pygix` branch and its security-audit base.
+   Refresh the three bundled prerequisites and propagate native errors from
+   fallible path, configuration, reference, shallow-state, and worktree queries.
+
 ## 0.1.0 (2026-10-05)
 
 ### New Features