fix: Prevent `filterUsingTasks` `--filter` from pulling dependents into Task Graph (#12535)
## Summary
- `--filter ./packages/*` with `filterUsingTasks` enabled was
incorrectly including apps in the task graph
- `filter_engine_to_tasks()` was calling `retain_affected_tasks()` which
does a reverse DFS (finding dependents) before a forward DFS (finding
dependencies) — correct for `--affected`, wrong for `--filter`
- Added `Engine::retain_filtered_tasks()` that does forward DFS only
(transitive dependencies for execution, no dependent expansion)
## Why
When a user writes `--filter ./packages/*`, they expect only tasks from
`packages/*` to run. The `...` dependent/dependency expansion is handled
during selector resolution — the final pruning step should only add
upstream dependencies needed for execution, not pull in downstream
consumers.
## How to test
`cargo test -p turborepo-lib -- task_filter` — includes a regression
test (`filter_does_not_include_dependents`) that sets up `app#build ->
ui#build` and asserts filtering to `ui` does not pull in `app`.