feat: implement changed-file path policy and resolver for Git diffs

[dbrosio3]

Description

Closes #5.

Adds the reusable changed-file path-policy seam for Pushgate's v2 runner work. The new TypeScript module resolves changed files against the configured local review.target_branch using the documented <target_branch>...HEAD range, preserves normalized file metadata for downstream deterministic checks and AI review, and fails explicitly when the configured target ref or merge base cannot be used.

This intentionally stops at the core seam: wiring the installed runner to execute policy and deterministic commands remains follow-up runner/check work.

Type of change

• fix: — Bug fix (patch version bump)
• feat: — New feature (minor version bump)
• feat!: / fix!: — Breaking change (major version bump)
• docs: — Documentation only (no version bump)
• chore: — Maintenance or config (no version bump)
• refactor: — Code restructure, no behaviour change (no version bump)

Changes made

• Added src/path-policy with a normalized ChangedFile contract, target/diff metadata, typed policy errors, NUL-delimited Git parsing, rename metadata, and binary detection.
• Added gitignore-like ignore_paths filtering through the focused ignore dependency.
• Added a tool-facing path selector that applies extension filtering and keeps deleted files out of future command argv while preserving them in normalized metadata.
• Added temp Git repo tests for modified, added, deleted, renamed, binary, ignored, and space-containing paths, plus missing target-ref, missing merge-base, and Git inspection failures.
• Updated README, schema, and docs to define local target-ref behavior, gitignore-like ignore semantics, and the current macOS/Linux support boundary.

Testing

• pnpm test passes
• pnpm run build passes
• pnpm run check:shell passes with no output (not run; no shell scripts changed)
• pnpm run lint:shell passes (not run; no shell scripts changed)
• Manually tested the hook on a real repository (not in scope; runner wiring is follow-up work)
• Tested on macOS
• Tested on Linux

Checklist

• Commit messages follow Conventional Commits
• No eval, heredoc variable expansion, or unquoted variable interpolation in shell scripts
• File lists passed as arrays, never as interpolated strings
• VERSION, CHANGELOG.md, .release-please-manifest.json, and release-please-config.json were not manually edited — these are managed by release-please
• New template added to the table in README.md (not applicable)
• New template name added to install.sh usage comment (not applicable)

Screenshots / output

No terminal UI changes. Verification run locally:

pnpm test
pnpm run build