feat(pm): derive a PR's file list three-dot in check-governed-merges — --pr and --branch (#17504)

* feat(pm): derive a PR's file list three-dot in check-governed-merges (--pr / --branch)

`--test` takes a caller-derived path list and nothing said how to derive it.
The two obvious derivations disagree on any branch behind `main`: two-dot adds
main's own newer commits, so the governance predicate can answer GOVERNED for
paths a PR never touched.

Adds `--pr <n>` (the API's changed-files list, three-dot by construction,
paginated and proven against the PR's own count, renames contributing BOTH
paths) and `--branch <ref>` (merge-base three-dot, offline, `--no-renames` so a
rename out of a governed path still reads as a hit). Each prints the derivation
it used. Both refuse rather than fall back to two-dot when the derivation
cannot be made. `--test`'s stdout is unchanged; the three-dot note goes to
stderr so the enqueue hook's JSON reading is untouched.

Claude-Session: https://claude.ai/code/session_01YKEjmbYNvYWJvWGSWx26zK
Co-authored-by: Claude <noreply@anthropic.com>

* test(pm): pin the three-dot derivation, its refusals and the card's reproduction

A new self-test battery (43 cases): the Link page walk, a rename reaching the
predicate as both of its paths, a walk the PR's own count contradicts, the
channel chosen once and never spliced mid-walk, every --branch leg on an
injected git, and the card's own reproduction run end to end on a real repo —
a branch behind a main that has since touched a governed path answers GOVERNED
two-dot and NOT governed three-dot, and the verdict is byte-identical through
--branch and through --test on the same list.

Claude-Session: https://claude.ai/code/session_01YKEjmbYNvYWJvWGSWx26zK
Co-authored-by: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-litant