Add CBM_EXTRA_SKIP_DIRS env var for site-specific always-skip directories

[chethanuk]

What does this PR do?

Adds a CBM_EXTRA_SKIP_DIRS environment variable so callers can skip extra,
site-specific directory names during indexing without a rebuild.

Motivation. Prior AI-tooling output directories (.codegraph/,
graphify-out/, .wiki/, .understand-anything/) get walked and parsed as
source during indexing, since none are in the universal skip list
(ALWAYS_SKIP_DIRS in src/discover/discover.c) or in target repos' own
.gitignore. Hardcoding these four names would fix only this case; the general
problem is broader (a .dbt target dir, a Terraform state dir, etc.) and a
rebuild per new name does not scale.

What changed.

• src/discover/discover.c: cbm_should_skip_dir now also skips names listed
  in CBM_EXTRA_SKIP_DIRS (comma-separated, whitespace-trimmed), checked
  alongside the hardcoded list and applied in every mode. The truly universal
  ALWAYS_SKIP_DIRS list is left untouched. The value is read through
  cbm_safe_getenv into a local buffer — matching the rest of the codebase — so
  it is thread-safe (raw getenv's pointer can be invalidated by a concurrent
  setenv/putenv) and correct for UTF-8 environment values on Windows. The
  CSV scan is non-mutating, so the copied buffer is never altered in place.
• tests/repro/repro_invariant_discovery_fqn.c: adds table-driven
  invariant_discovery_env_extra_skip_dirs — a name is discovered by default,
  skipped once CBM_EXTRA_SKIP_DIRS lists it (including a whitespace-padded CSV
  entry to exercise trimming), and discovered again after the var is cleared,
  proving the behavior is genuinely env-gated. Uses the portable
  cbm_setenv/cbm_unsetenv wrappers so it also compiles on Windows.
• docs/cbmignore.md: documents the new opt-in. CBM_EXTRA_SKIP_DIRS is set by
  the caller invoking indexing, not by the indexed repo, so it does not weaken
  the "not overridable from a repo-local ignore file" guarantee.

How verified

• str_in_env_csv / cbm_should_skip_dir in src/discover/discover.c compile
  clean (cc -fsyntax-only); the repro test translation unit compiles clean.
• Extracted the CSV parser into a standalone harness and asserted the
  baseline/skip/restore and whitespace-trimming cases (listed name skipped,
  padded entries trimmed, substrings not matched, unset/empty env not skipped).
• Full make -f Makefile.cbm test requires the project toolchain; the new
  behavior is covered by the table-driven repro test above.

Checklist

• Every commit is signed off (git commit -s)
• Tests pass locally (make -f Makefile.cbm test)
• Lint passes (make -f Makefile.cbm lint-ci)
• New behavior is covered by a test (reproduce-first for bug fixes)