Codex/changed file range semantics

[dbrosio3]

This pull request introduces a more robust and explicit mechanism for handling changed file resolution and Git ranges in both the local AI review and deterministic scanning phases. The main improvements are the introduction of distinct reviewRange and scanRange properties in the changed file resolution logic, ensuring that local AI and deterministic scanners (like Gitleaks) operate over the correct and intended Git ranges. The documentation and tests have also been updated to clarify and verify this behavior.

Changed file resolution and Git range handling:

• Added reviewRange (for local AI diff context) and scanRange (for deterministic scanners) properties to the ChangedFileResolution type, and updated all relevant code to use these properties instead of constructing Git ranges ad-hoc. (src/path-policy/types.ts, src/path-policy/index.ts, src/path-policy/git-resolution.ts, [1] [2] [3] [4] [5]
• Updated the Gitleaks plugin to use the new scanRange property for its --log-opts argument, ensuring it scans the correct commit range. (src/runner/plugins/gitleaks.ts, src/runner/plugins/gitleaks.tsL115-R115)

Documentation updates:

• Clarified in the README.md and docs/v2-config-schema.md that changed file resolution now exposes both a review range and a scan range, and described how these are used by local AI and deterministic scanning tools. [1] [2] [3] [4]

Test coverage improvements:

• Updated and added tests to verify that the new reviewRange and scanRange properties are correctly set and consumed throughout the codebase, including in plugin invocations and changed file resolution. (test/ai.test.ts, test/deterministic-runner.test.ts, test/path-policy.test.ts, [1] [2] [3] [4] [5]