go-git's tree decoder is permissive on purpose: tools that inspect
or recover repositories need to read tree objects whose entries do
not pass the index-side path-validation gate. Upstream Git keeps
the same split — `parse_tree_buffer`[1] is a no-op on names while
`fsck_tree`[2] is the validator — and exposes the latter through
`git fsck`. Add the read-side counterpart to Tree.Encode's
producer gate: a Tree.Validate method that mirrors `fsck_tree`'s
structural ruleset. Decode stays as-is; callers that want
fsck-shaped reporting call Validate.

The ported rules cover null entry hashes, slashes in names, empty
names, ".", "..", ".git" with HFS+/NTFS disguises (already handled
by pathutil.ValidTreePath), bad file modes, duplicate entries,
mis-sort, names longer than 4096 bytes, and the four
FSCK_MSG_*_SYMLINK rules for ".gitmodules", ".gitattributes",
".gitignore", and ".mailmap". Two fsck_tree warnings —
zero-padded modes and the non-canonical 0100664 bits — are not
surfaced: both require retaining the raw octal mode string from
the wire, which canonicalTreeMode drops. The structural rules are
the load-bearing ones for refusing malformed trees.

The new pathutil helpers IsHFSDotGitattributes /
IsHFSDotGitignore / IsHFSDotMailmap and their NTFS counterparts
extend the existing IsHFSDotGitmodules / IsNTFSDotGitmodules pair
with the short-name prefixes upstream uses for the same names
(`gi7d29`, `gi250a`, `maba30`).

Violations are returned as an errors.Join of individual rule
errors, each wrapping ErrInvalidTree, so callers can match either
the umbrella or specific rules (ErrDuplicateEntry,
ErrEntriesNotSorted, pathutil.ErrInvalidPath) with errors.Is.

[1]: https://github.com/git/git/blob/v2.54.0/tree.c#L175-L184
[2]: https://github.com/git/git/blob/v2.54.0/fsck.c#L616-L800

Assisted-by: Claude Opus 4.7
Signed-off-by: Hidde Beydals <[email protected]>

Encode previously enforced a subset of Tree.Validate's rules inline
(ValidTreePath, duplicate detection, sort order). With Validate
available as the structural ruleset, Encode can run it once at the
top and skip the duplicated checks — both shrinking the encoder and
widening the producer-side gate to refuse the rules Validate already
catches but Encode did not: null entry hashes, oversize names, and
symlinks disguised as `.gitmodules` / `.gitattributes` /
`.gitignore` / `.mailmap`.

The widened gate exposes one pre-existing path that built trees
containing entries with the zero hash: buildTreeHelper turned every
index entry into a tree entry, including those carried through go-git#1773
to avoid a panic during recursive tree construction. Skip such
entries at the top of commitIndexEntry so commit produces a
well-formed tree without regressing the panic-safe behaviour the
go-git#1773 fix introduced.

Assisted-by: Claude Opus 4.7
Signed-off-by: Hidde Beydals <[email protected]>