v1.18.0: fix two silent false cleans in diff mode

Two ways vibecheck printed "No issues found" and exited 0 with an eval() in the file. If you use --diff in CI, upgrade.

--fix shifted lines out from under the diff map

Attribution comment on line 1, eval() on line 3. --diff --fix --fail-on error fixed line 1, looked for the eval on line 3 where it no longer was, and exited 0. All three diff modes.

New shiftDiffMap() shifts the map by the lines the fixer actually removed, so no second git read and diff semantics stay exact.

Symlinked scan paths dropped every file

git rev-parse returns a canonical path; the scan root is whatever you typed. On macOS /tmp is a symlink to /private/tmp, so every changed file looked like it was outside the scan root. Same repo, same content: aliased path found nothing, canonical path found two findings.

Baselining could zero the slop score

Same code, nothing fixed: 74 → 100 after --update-baseline, and --min-score 100 then passed on a file with eval(). The score now counts baselined findings. Baselining defers slop, it doesn't remove it; --fail-on gates new findings.

Smaller

• --diff --staged no longer silently drops --diff
• --score --format sarif prints the score to stderr instead of nothing
• The calibration guard recomputes quartiles from the corpus instead of trusting cached values, which had let a corpus edit move the real p25 grade C→B with every test green

389 tests, up from 376.

Known, not fixed in this release

Four more silent false cleans turned up while reviewing this one. All pre-existing:

• --staged scans working-tree content, not staged content. Stage an eval(), overwrite the working copy with clean code, and --staged --fail-on error exits 0 while the commit carries the eval.
• Passing a symlinked file explicitly skips it (this release fixed symlinked directories).
• Unreadable files and files over the 1MB cap are reported clean, silently.
• A filename with a leading ! or a backslash is treated as a glob and skipped.