Add tool-surface diff MVP

[pengfei-threemoonslab]

Summary

• Add JSON-first tool_surface_facts and tool_surface_diff fields with report schema v0.10.
• Add agents-shipgate scan --diff-from and baseline schema v0.3 snapshots for surface comparisons.
• Render the diff in Markdown reports, Release Evidence Packets, GitHub summaries, and PR comments while keeping release_decision.decision, exit behavior, and SARIF unchanged.
• Add GitHub Action diff_from, diff_base, and diff_enabled support plus docs, examples, schemas, fixtures, and tests.
• Address review feedback for accepted-debt overlap, pre-v0.10 reference reports, markdown escaping, tempdir cleanup, PR comment highlight ordering, broadness-aware scope diffs, no-op CLI summaries, and v0.2 baseline diff-reference coverage.

Validation

• python scripts/generate_schemas.py
• python -m ruff check .
• python -m pytest (434 passed)

[pengfei-threemoonslab]

Addressed the pre-merge review feedback in 2a95d5d:

• Fixed new_findings so baseline-matched accepted debt is excluded from the new bucket.
• Preserved finding deltas for pre-v0.10 --diff-from reports that lack tool_surface_facts, while keeping the surface diff disabled with an actionable note.
• Escaped tool/tag values in GitHub Step Summary highlights.
• Cleaned up the temporary base worktree/tempdir after the current scan consumes the generated base report.
• Interleaved PR comment highlights with removed controls prioritized so they are not hidden by high-risk tag volume.
• Added extra="forbid" to the tool-surface diff models, documented scope-kind add/remove behavior, and regenerated schemas.

Validation rerun:

• python scripts/generate_schemas.py
• python -m ruff check .
• python -m pytest (431 passed)

[pengfei-threemoonslab]

Addressed the latest non-blocking review nits in a331516:

• Scope deltas now compare broad as well as tool membership.
• CLI output now prints Tool-surface diff: no changes for enabled no-op diffs.
• Added coverage for v0.2 baseline diff references that lack tool_surface_facts.

I left N1 as follow-up: adding description excerpts would change the JSON shape, while the MVP contract currently keeps deterministic hashes and the full current descriptions in the inventory.

Validation:

• python scripts/generate_schemas.py
• python -m ruff check .
• python -m pytest (434 passed)