Lore project remote pairing

Trap: using ctx.location.directory for project attribution and git remote looks right because it is the requested location, but it may be an unchecked nested path and can misattribute or leak another repository’s remote. Fix: derive both projectPath and gitRemote from host-resolved ctx.location.project.directory, store them as one pair, and never emit x-lore-git-remote for a non-Git project.