Add evidence-labeled pre-change intelligence

[lenhonbp]

Summary

Adds a project-agnostic pre-change advisory layer for CMI without weakening its local-first or human-review boundaries.

New intelligence

• bounded Git baseline: branch, commit, clean/dirty state, upstream, and ahead/behind context without absolute-path disclosure;
• deterministic project-boundary inference from workspace-relative paths and import edges;
• review-only proposals for missing task-relevant facts, decisions, and lessons;
• structured pre-change briefs combining ranked context, impact, inferred boundaries, risks, verification, assumptions, confidence, and provenance.

Interfaces

New CLI commands:

• cmi baseline
• cmi boundaries
• cmi memory-gaps <query>
• cmi prepare <change-goal>

New MCP tools/resources expose the same operations, and prepare_project_change now directs agents through the structured brief.

Integrity and safety

• no project-specific or product-specific hard-coding;
• no network access and no project-code execution;
• fixed Git argument arrays, bounded timeout/output, and no absolute local path in baseline output;
• all inferred architecture, risks, and memory gaps are explicitly advisory;
• memory suggestions never become durable knowledge without an explicit reviewed write;
• zero new runtime dependencies.

Validation

• adds dedicated advisor tests for Git privacy, generic boundary inference, proposal-only memory gaps, and composed change briefs;
• expands CLI and MCP interface tests;
• adds a versioned pre-change brief JSON Schema;
• updates README, architecture, MCP, security, roadmap, and changelog documentation.

Release note

This PR does not bump or publish the package version. A later substantive release should use the trusted publishing workflow and verify npm provenance.