Gitignored marker inside a workspace pointing back at the store, so
newgit commands run from inside a workspace find the real metadata and
know which instance they are standing in.
The materializer contract: a workspace presents a full, real, verifiable
Git repo at the binding record’s revision. Nothing outside this boundary
may care how that presentation is produced — this implementation clones;
a future one may project.