Realign undo with the evening rulings — repo-nested and identity anchors

Repo-nested boards bind native undo in every tier (25d2513): the
no-undo case is gone, makeHistoryProvider answers git or native, and
the native path provably never touches the enclosing repository's
.git. Session undo steps anchor by card identity, never by path
(9119aa1): HistoryAnchor carries the card UUID (plus comment/draft
vocabulary) and apply-time validation resolves the current folder via
the same both-container walk writeCardBody uses — a board-side lane or
trash move no longer stales the coarse close step, while a genuine
field collision still skips it whole.

2448 tests in 423 suites green.

Claude-Session: https://claude.ai/code/session_01CqjXB7ASoWtbyoGod68k97

Kanban/Git/BoardGitMode.swift

@@ -14,8 +14,10 @@ import Foundation
 ///
 /// `repoNested` is not "git mode with the repository somewhere else". A board inside a user's
 /// existing repository gets **no app-managed git at all** — "no nested repo, no commits into the
-/// user's repo, no undo" (06 ▸ Rules) — which makes it as distinct from `git` as `none` is, and the
-/// reason it is a case rather than a flag on `git`.
+/// user's repo" (06 ▸ Rules) — which makes it as distinct from `git` as `none` is, and the reason it
+/// is a case rather than a flag on `git`. What it no longer costs is ⌘Z: the native stack binds here
+/// too (re-ruled 2026-07-31 — 13-native-undo.md's header; `AppModel.makeHistoryProvider`), because
+/// that stack is memory-only and touches no repository, anybody's.
 ///
 /// ### The remote half is deliberately absent
 ///