phase: filter out non-draft item in "draft root"
The on-disk file can contain draft root that are descendants of secret root.
The resulting phase computation is correct, but the phases root content is
not. I will send another series to introduce code that remove some of the
cases where this can happens, but we first need to damage control the existing
case.
After this changeset, we can no longer advertise secret changeset as draft
root.