build-notepat: tighten gitDirty check to tracked-file changes only
\`git status --porcelain\` counts untracked files, so deploy.fish's
system/public/.commit-ref (written post git reset --hard) made every
lith build's version look "-dirty" even though the tree matched
origin/main exactly. Switching to \`git diff --quiet HEAD --\` which
only considers tracked modifications — no effect on dev builds with
actual uncommitted changes. Also gitignores .commit-ref for good
measure.