Fix committed worker scope checks

[SetraTheXX]

Summary

Fixes worker scope validation so committed branch changes are checked in addition to git status --short.

Fixed

• Adds baseCommit to registered worktrees
• Checks git diff --name-only <baseCommit>...HEAD
• Prevents workers from committing files outside allowedFiles
• Prevents committed forbidden file changes from passing post-check
• Keeps .cewp-worker-output/** as allowed runtime output

Safety

• Old runs without baseCommit fail safely
• No merge/push/publish automation added
• No package version bump

Verification

• committed allowed change PASS
• committed outside allowed FAIL
• committed forbidden FAIL
• mixed committed/uncommitted scope test PASS
• npm pack --dry-run PASS

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.