fix: --git mode reports unrelated changes from prior undeployed commits

[TsekNet]

Problem

When using --git in CI, fleet-plan compares the MR branch YAML against the live Fleet API state. In environments with staged/delayed deployments, main can be days ahead of production. This means every MR that touches a team file or global config gets a fleet-plan comment showing all pending undeployed changes, not just the changes introduced by the current MR.

This trains users to ignore fleet-plan comments because the findings appear unrelated to their changes.

Example (team scope)

1. MR A removes a policy from teams/foo.yml, merges to main
2. Staged release hasn't deployed yet, so the policy still exists in Fleet
3. MR B adds a query to teams/foo.yml
4. fleet-plan on MR B reports: REMOVED: policy + ADDED: query
5. The policy removal is noise for MR B's author

Example (global scope)

1. Prior commits removed global queries from base.yml, merged to main
2. Staged release hasn't deployed, so the queries still exist in Fleet
3. MR C adds a single global query to base.yml
4. fleet-plan on MR C reports: ADDED: query + 17 REMOVED queries + 2 config changes
5. Only the 1 added query is from MR C

Root cause

filterResourceDiff() builds a source map from proposed (MR branch) YAML only. Deleted resources have no proposed entry, so sourceNames[name] returns \!ok, and the filter defaults to return true (keep). The global diff block had no filtering or subtraction at all.

Fix

Base-branch subtraction: parse the base branch YAML as a second "proposed" state, diff it against the same live Fleet state, and subtract those pre-existing deltas from the MR's diff. Only the incremental changes introduced by the current MR are reported.

Applies to both per-team and global (default.yml/base.yml) diffs.

Additional fixes discovered during implementation

• resolveDefaultFile placed merged base.yml+env in /tmp, breaking path resolution for global queries
• ResolveScope didn't include base.yml in changedFiles, preventing baseline extraction for global changes
• buildSourceMap didn't register team source file for policies, queries, scripts, profiles (resources added via new path: refs in team YAML were filtered out)
• Global diff was skipped when both global and team files changed (team filter suppressed global block)
• --verbose flag added for baseline subtraction debugging

Ref #15

[TsekNet]

Resolved via #27