fix: honor pinned gbrain code sources

[onfire7777]

Summary

• honor a valid worktree .gbrain-source pin as the canonical gbrain code source
• keep an existing same-path source when gbrain sources rename is unavailable or fails, avoiding duplicate source registration and preserving pages
• update regression tests for pinned-source migration behavior and the current explain_level default contract

Verification

• bun test test/gstack-gbrain-sync.test.ts
• bun test test/explain-level-config.test.ts
• real sync in Siri/Codex repo: 3 ok, 0 error, 0 skipped, source gstack-code-94f0884f-f4fca3, page_count=46
• verified exactly one matching gbrain source for /Users/admin/Documents/Codex/2026-05-23/gsd-discuss-phase-users-admin-codex

Notes

• full non-e2e suite was sampled but is noisy in this local checkout with unrelated historical failures; the focused changed areas pass.

[BenjaminDSmithy]

Hit this same bug on a worktree where the source had been registered before the origin remote was set — deriveCodeSourceId recomputed a new id from the canonicalized origin + hostname-folded path hash, didn't match the existing source id, and ensureSourceRegistered got rejected by gbrain with:

path "/Users/benjamin/gbrain" overlaps with existing source "gstack-code-gbrain-76f26696". Overlapping sources are not allowed.

Existing source id gstack-code-gbrain-76f26696 is gstack-code-<basename>-sha1(mbp.local::/Users/benjamin/gbrain).slice(0,8) — the basename fell back to gbrain because origin wasn't set when it was first registered. Then I added the GitHub remote (BenjaminDSmithy/gbrain-private) and the next /sync-gbrain started computing gstack-code-benjaminsmithy-gbrain-private-<hash> instead. The .gbrain-source pin still pointed at the correct existing source though, so honoring it (as this PR does) is the right move.

Setup specifics:

• gstack v1.48.0.0 (commit a6fb317)
• gbrain CLI v0.41.3.0 (postgres engine via local Supabase)
• macOS 14, hostname mbp.local

Independently arrived at the same fix shape (readPinnedCodeSourceId helper with the same [a-z0-9-]{1,32} regex contract + pin-first branch in runCodeImport + skip the legacy/hostname-fold migration paths when honored). Your PR is more thorough (refactors HostnameFoldMigration to a kept-existing kind + ships tests); recommending you keep it as-is rather than my variant.

Happy to test against this PR's branch on my repro if it helps move review along. The fix is the load-bearing path between a working /sync-gbrain and a permanently-broken code stage on existing installs.

[onfire7777]

Rebased onto current garrytan/main on 2026-06-04 and resolved the test comment conflict in test/explain-level-config.test.ts. Local verification passed: bun test test/explain-level-config.test.ts test/gstack-gbrain-sync.test.ts (43 pass, 0 fail) and bun run build after installing from bun.lock. GitHub now reports the branch as MERGEABLE; no GitHub check runs are currently attached to this PR.