[Agent-first UX][P0] Normalize committed and worktree changes into one coherent verification diff

[pengfei-threemoonslab]

Parent epic: #338

Problem

A normal coding-agent workflow can contain both committed branch changes and uncommitted review follow-ups. When the same path appears in both the base-to-HEAD diff and the HEAD-to-worktree overlay, verification currently emits multiple records for that path and fails closed with SHIP-AGENT-BOUNDARY-INPUT-INCOMPLETE / boundary_diff_shape_invalid.

In a real issue-to-PR workflow, seven valid files were reported as seven human-review findings solely because each path appeared once in the committed branch diff and once in the worktree overlay. The user had to manually commit the follow-up before verification could produce a coherent result.

This is an input-normalization defect, not a semantic boundary risk.

User impact

• Coding agents are stopped during ordinary review-fix iterations.
• Users must understand Git diff internals and manually commit to repair verifier input.
• Identical root causes are emitted as many per-file human-review findings.
• A release-safety control creates a workflow deadlock instead of evaluating the effective change.

Proposed direction

Construct one deterministic effective-head snapshot and compare it once against the merge base. For example:

1. Resolve the committed HEAD tree.
2. Apply the index/worktree overlay to a temporary, content-addressed snapshot.
3. Generate one merge-base-to-effective-head diff.
4. Bind the overlay/snapshot identity into the verification request and receipt.

An equivalent deterministic per-path merge is acceptable if it correctly preserves add/delete/rename/mode semantics.

Acceptance criteria

• A path modified in both a branch commit and the uncommitted worktree produces one coherent diff record.
• Valid overlapping edits do not emit boundary_diff_shape_invalid.
• Add, delete, rename, mode-change, staged-only, unstaged-only, and untracked cases remain fail-closed when genuinely ambiguous.
• Committed --base ... --head ... verification behavior remains unchanged.
• The terminal receipt binds the exact effective-head/worktree-overlay identity.
• A regression test reproduces: committed issue fix → uncommitted review follow-up on overlapping files → successful worktree verification.
• One structural root cause is aggregated instead of repeated as one finding per affected path.

Product principle

A valid coding-agent worktree is a first-class verification input, not an error state.