Closes #2391

Root cause

collect_files.rs's ignore::WalkBuilder set .hidden(true), which blanket-skips both hidden directories AND hidden files. Dotfile-named source files are common and legitimate:

• .terraform.lock.hcl — Terraform's dependency lock file, meant to be committed to git
• .pa11yci.authed.cjs — a pa11y accessibility-testing config

Both were silently dropped by the native collector, which then logged "likely a Rust extractor bug" and paid a second WASM parse pass to backfill them — but the real bug was file discovery, not extraction (the extraction logic itself is correct, as proven by WASM producing identical symbols once it got the chance to see the file).

The JS/TS collector (shouldIgnore in shared/constants.ts) only ever skips hidden directories, never files. collect_files.rs now matches that asymmetry exactly — the existing filter_entry closure right below .hidden(false) already re-implements hidden-directory skipping independently, so directory-level behavior (.git, .next, arbitrary dotdirs) is unchanged.

Secondary defect (same issue report)

The build-completion log line (Native build orchestrator completed: N nodes, M edges, K files) reflected only the files the native orchestrator itself collected, captured before any WASM backfill inserted additional file nodes — so K under-reported relative to codegraph stats whenever a backfill happened for any reason. This is the same shape as #1452's node/edge under-report, fixed the same way: re-derive the count (SELECT COUNT(*) FROM nodes WHERE kind='file', matching how codegraph stats counts files) whenever a post-pass wrote data.

Verification

• Reproduced both defects using the issue's exact file shapes (a real .terraform.lock.hcl with a provider { ... hashes = [...] } block, and a .cjs file) against the pre-fix binary; confirmed the warning, the backfill, and the undercounted completion line.
• Rust: 2 new unit tests in collect_files.rs (collect_finds_dotfile_named_source_files, collect_still_skips_hidden_directories) — both verified to fail without the fix (temporarily reverted .hidden(false) → .hidden(true), confirmed failure, restored). Full cargo test: 1034 passed. cargo clippy --all-targets -- -D warnings and cargo fmt --check clean.
• TS: 3 new integration tests in tests/integration/issue-2391-hidden-dotfile-native-drop.test.ts covering the .hcl and .cjs dotfile cases plus a hidden-directory-still-excluded regression guard — all verified to fail without the Rust fix (same revert-rebuild-confirm-restore cycle).
• The secondary (file-count) fix was verified manually rather than via an isolated automated test: reproduced the original bug (both defects present), confirmed the completion log undercounted relative to codegraph stats; then restored only the file-count fix (keeping the primary bug reverted) and confirmed the log became correct; then restored both fixes together. No independent automated regression test was constructible for the secondary defect alone — the only known real-world trigger for "native's own file collector misses a file WASM would find" is the primary bug this same PR fixes, so once it's fixed there's no remaining scenario in this codebase where the two file counts diverge. Documented this explicitly in the test file's top comment for future readers.
• npm test: 5323 passed. npm run lint clean. codegraph diff-impact --staged -T: bounded to runPostNativePasses and its normal build-pipeline callers.

Not in scope

No Rust changes needed beyond collect_files.rs — the HCL/JS extractors' own logic was already correct; native and WASM already agree on symbol shape once native can see the file. No other WalkBuilder instances exist in the Rust codebase (grepped to confirm).