Realign undo with the evening rulings — repo-nested and identity anchors

Repo-nested boards bind native undo in every tier (25d2513): the
no-undo case is gone, makeHistoryProvider answers git or native, and
the native path provably never touches the enclosing repository's
.git. Session undo steps anchor by card identity, never by path
(9119aa1): HistoryAnchor carries the card UUID (plus comment/draft
vocabulary) and apply-time validation resolves the current folder via
the same both-container walk writeCardBody uses — a board-side lane or
trash move no longer stales the coarse close step, while a genuine
field collision still skips it whole.

2448 tests in 423 suites green.

Claude-Session: https://claude.ai/code/session_01CqjXB7ASoWtbyoGod68k97

Kanban/Tier/Tier.swift

@@ -26,8 +26,8 @@ public enum Tier: String, Sendable, Equatable, Codable, CaseIterable {
     /// Lanework Pro — an active auto-renewable subscription. It is what puts git on the table; which
     /// substrate a given board then binds is the *board's* answer, not this case's (re-ruled
     /// 2026-07-31 — `AppModel.makeHistoryProvider`): the git provider on a git board
-    /// (06-history-undo.md, 07-sync-collab.md), the same native stack the free tier uses on a gitless
-    /// one, nothing on a repo-nested one.
+    /// (06-history-undo.md, 07-sync-collab.md), and the same native stack the free tier uses on every
+    /// board without app-managed git, repo-nested ones included.
     case pro
 }