ci(lint): scan clang-tidy push-event delta, not full tree (ADR-0133)

[lusoris]

Summary

• Unify clang-tidy job scoping across push and pull_request events — both now scan only the event's delta.
• Previous push-event scan walked git ls-files over the whole repo and tripped on long-latent warnings in vendored libvmaf/src/svm.cpp (libsvm) and CUDA sources compiled without CUDA headers (unrelated to the merged PR).
• actions/checkout@v6 bumped to fetch-depth: 0 so the <before>..HEAD range is locally reachable without a second fetch.
• ADR-0133 captures the decision + alternatives.

Symptom addressed

actions/runs/24686615999/job/72197545195 failed on master after the PR #70 squash-merge landed. The PR itself passed clang-tidy (delta-scan). The push-event scan then processed every .c/.cpp in the tree, surfacing clang-analyzer-unix.Malloc in svm.cpp:2984 and a clang-diagnostic-error cascade in libvmaf/src/cuda/*.c (CUDA types unknown because the workflow sets up without CUDA).

Test plan

• This PR's own clang-tidy run passes (delta = the workflow YAML change + ADR files, no C/C++ deltas so the job short-circuits to "no C/C++ changes").
• After merge, the subsequent push-event clang-tidy run on master succeeds (delta of a push with no C/C++ changes = empty → skip).
• Regression guard: a follow-up PR that modifies any C file still triggers clang-tidy on that file on both PR and post-merge push.

Deep-dive deliverables (ADR-0108)

• no digest needed: trivial — single-file workflow reshape whose alternatives live in ADR-0133.
• Decision matrix — captured in ADR-0133's ## Alternatives considered (four options: silence warnings, exclude paths, delta-scan chosen, drop push trigger).
• no rebase-sensitive invariants — .github/workflows/lint-and-format.yml is fork-only CI and does not live in an upstream-mirrored file.
• Reproducer / smoke-test command — pasted below under "Reproducer".
• no CHANGELOG entry: CI-only — workflow semantics don't surface to library users.
• no rebase impact: CI-only — .github/ is fork-wins per /sync-upstream conflict policy.

Reproducer

# Before: push-event scan touched every tracked C/C++ file
# After: push-event scan processes only the push's <before>..HEAD delta.
gh workflow run "Lint & Format — Pre-Commit / Clang-Tidy / Cppcheck / Python / Shell"
# Expected post-merge master run on a non-C push: "No C/C++ changes" -> green.

🤖 Generated with Claude Code