fix(backports/apply): scope cherry-pick to target package, ignore other-package conflicts

[mrodm]

Proposed commit message

fix(backports/apply): scope cherry-pick to target package, ignore other-package conflicts

WHAT: Added `resetNonPackageChanges(relPkgDir string)` in `apply.go`. After
every cherry-pick (and after changelog.yml is restored), this function iterates
over `git status --porcelain` and resets every file whose path falls outside the
target package directory back to HEAD:

- `git checkout HEAD -- <file>` resolves both regular (UU) conflicts and clean
  staged changes.
- If the file does not exist in HEAD (modify/delete DU conflict, i.e. a package
  removed from the backport branch), falls back to `git rm --force -- <file>`.

Errors from either command are non-fatal — `conflictingFiles()` is the
authoritative gate that determines whether anything real remains unresolved.

WHY: When a commit on `main` touches more than one package and is cherry-picked
onto a backport branch that does not include all of those packages, `git
cherry-pick` produces conflicts in the absent packages (modify/delete DU) or UU
conflicts when the branch evolved those files independently. The `apply` command
was surfacing these as `status: conflict`, blocking the backport even when the
target package's changes had applied cleanly — the contributor had no way to
resolve something that was never their concern.

Three integration tests added to `apply_integration_test.go`:

1. `TestApplyIntegration_IgnoresConflictsInOtherPackages` — other package absent
   from branch; DU conflict resolved via `git rm` → `status == "success"`.
2. `TestApplyIntegration_IgnoresRegularConflictInOtherPackage` — both packages
   present; branch changed other-package description independently (UU conflict);
   `git checkout HEAD` restores branch version → `status == "success"`.
3. `TestApplyIntegration_DiscardsCleanChangesInOtherPackage` — both packages
   present; cherry-pick applies cleanly to other package; clean change discarded
   → `status == "success"`, other package stays at branch version.

Author's Checklist

• go test -run TestApplyIntegration ./dev/backports/apply/ — all 14 integration tests pass (11 pre-existing + 3 new)
• No changes outside dev/backports/apply/ — root module build unaffected

How to test this PR locally

# Run the integration tests for the apply package
go test -v -run TestApplyIntegration ./dev/backports/apply/

# The three new scenarios specifically:
go test -v -run 'TestApplyIntegration_IgnoresConflictsInOtherPackages|TestApplyIntegration_IgnoresRegularConflictInOtherPackage|TestApplyIntegration_DiscardsCleanChangesInOtherPackage' ./dev/backports/apply/

Real-world examples:

• mrodm/integrations#66 — failure case: backport of a commit touching multiple packages incorrectly reported status: conflict before this fix
• mrodm/integrations#68 — success case: same scenario after this fix, backport completes cleanly

Related issues

• Closes backport: automate backport PR creation from checklist and fix changelog links #19214
• Relates Test package pr - multiple packages  mrodm/integrations#68
• Relates Test skip security_detection_engine checklist mrodm/integrations#66

---

This PR was generated with the assistance of Claude (claude-sonnet-4-6).

[mrodm]

If a Pull Request contains changes in two different packages and it is selected to backport to one of those specific packages, this function removes the files that are not related to the selected package.

For instance, a pull request updates kubernetes and security_detection_engine packages. The user selects to backport just the kubernetes package. Then this process ensures that the changes about security_detection_engine are not part of the backport process.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: f637be1

cc @mrodm

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request