v0.9.29

Portability, hook-safety, and resolution-accuracy fixes.

**Node-id portability**

- Absolute-path / machine-slug node ids no longer leak into edge endpoints (#2231, #2243). Module-top-level `indirect_call` sources, bash `source`/script-invocation targets, and other producers that minted an id from an absolute path are now canonicalized to the root-relative node id by a general backstop, so `graph.json` link endpoints are portable across machines and clones.

**Hook safety**

- The post-commit hook no longer overwrites an existing `graph.json` it merely failed to read (#2251). If the existing graph is over the size cap or unparseable, the rebuild refuses to write (matching the CLI) instead of replacing it with a code-only extraction; the `--no-cluster` write is now atomic with a protected-graph backup.
- The post-commit hook launcher no longer pops a focus-stealing console window on Windows (#2253, thanks @hopstreax).

**Resolution / extraction**

- False `indirect_call` edges from JS/TS closure arguments are gone (#2241, thanks @Yyunozor): a closure parameter now shadows outer names, so `rows.map(r => ...)` no longer binds `r` to a corpus-wide callable of the same name.
- Scala `self`-type annotations (`self: A with B =>`) emit `requires` edges to the required traits (#2052, thanks @Yyunozor).
- Rationale node labels are whitespace-normalized before the 80-character truncation, so labels are clean and filenames aren't malformed (#2206, thanks @Yyunozor).

**Filtering / export**

- Committed `.env.example` / `.env.sample` / `.env.template` templates are indexed instead of dropped by the sensitive-file filter, while real `.env` files (and templates under a secrets directory) stay excluded (#2184, thanks @SyedFahad7).
- Obsidian export no longer hides notes whose label starts with a dot (`.env` -> `dot-env`; an all-dot label falls back to `unnamed`) (#2205, thanks @SyedFahad7).