feat(pm): derive a PR's file list three-dot in check-governed-merges (--pr / --branch)

`--test` takes a caller-derived path list and nothing said how to derive it.
The two obvious derivations disagree on any branch behind `main`: two-dot adds
main's own newer commits, so the governance predicate can answer GOVERNED for
paths a PR never touched.

Adds `--pr <n>` (the API's changed-files list, three-dot by construction,
paginated and proven against the PR's own count, renames contributing BOTH
paths) and `--branch <ref>` (merge-base three-dot, offline, `--no-renames` so a
rename out of a governed path still reads as a hit). Each prints the derivation
it used. Both refuse rather than fall back to two-dot when the derivation
cannot be made. `--test`'s stdout is unchanged; the three-dot note goes to
stderr so the enqueue hook's JSON reading is untouched.

Claude-Session: https://claude.ai/code/session_01YKEjmbYNvYWJvWGSWx26zK
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude