v3.12.0: type-aware audit enablement, rename-aware gating, sturdier baselines

Type-aware analysis and audit --gate new-only now work together out of the box, audits survive git mv, and health baselines got sturdier.

Type-aware + audit, fixed end to end

Three reports converged on the same enablement wall, and all three are gone:

• One config is enough. With typeAware.enabled in .fallowrc, audit --gate new-only no longer exits 2 when base and head semantic identities differ: attribution falls back to identity-independent syntactic sets with a clear warning, semantic-only findings demote to advisory, and a genuinely new finding still fails the gate. A global --no-type-aware flag and an audit.typeAware config field give you an explicit syntactic escape hatch, and macOS /var vs /private/var temp paths no longer abort the run. Thanks @hckhanh for the detailed enablement-DX report.
• Adding a file no longer degrades the gate. Identity comparison now uses the compatibility rules the identity type was designed with instead of raw equality, and the sidecar's project hash no longer includes the root file listing, so the everyday "this PR adds a new .ts file" diff compares cleanly. Thanks @lightsound for the precise source-level analysis.
• The npm sidecar wiring is repaired. fallow@3.11.0 pinned fallow-type-aware to the previous version while the launcher requires an exact match, so the sidecar never wired and type-aware hard-failed on npm installs. Both the manifest and the release pipeline now bump the pin in lockstep. Thanks @lightsound for the report and the bun workaround notes.

Audit survives renames

git mv no longer turns audit --gate new-only red: base findings relocate onto post-rename paths via git rename detection across dead code, complexity, duplication, styling, and cycles, so pure renames attribute as inherited while a rename with edits still gates genuinely new debt. Validated on a real multi-directory rename that previously reported 21 introduced findings and now reports zero. Thanks @YoniChechik for the excellent report with the minimal repro.

Health and analysis improvements

• Baselines warn before they rot: a baseline run reports partial staleness (human warning plus a machine-readable baseline_staleness summary) instead of only complaining at zero overlap, and identity-mode baselines follow a file move when exactly one unclaimed bucket carries the same function identity.
• MCP baseline control: check_health and audit accept baseline_mode, and a count-mode save refuses to silently overwrite an identity baseline.
• Mock-aware coverage covers more idioms: aliased vi imports, vitest namespace imports, and jest.mock now mask test reachability the same way vi.mock does.
• Flag-value dependency crediting is table-driven: CLI conventions live in a data catalogue, so covering a new tool is a one-entry change.
• Performance: reference provenance moved into a sparse side table, restoring the 16-byte per-reference footprint for projects that never mock, and profiled test reachability caps at a safety limit with a coarse fallback on extreme monorepos.

Full Changelog: v3.11.0...v3.12.0