Make --changed policy-aware and deepen format-specific extraction

[thossullivan]

Problem

--changed primarily follows added model-ID lines. Policy, route, resolver, feed, rename, or nearby provider-signal changes can make an untouched reference newly actionable.

Scope

• Compute an affected set for policy, route, resolver, feed, rename, and provider-signal changes.
• Re-evaluate affected existing references while keeping scans bounded.
• Add format-specific extraction only from documented real-repository false-negative fixtures.
• Report why an unchanged line was included.

Acceptance / UAT

• Cover threshold/via/ignore, resolver route, SDK signal, rename, and newly retired feed changes.
• Incremental output includes every newly actionable supported finding from full base/head comparison.
• Incomplete coverage never produces a clean changed gate.
• Real-repository benchmarks enforce file/time bounds.
• Preserve completed AR-23: scanner language coverage creates obvious false negatives. #32 coverage and zero-dependency Node 22/package tests.