feat(gate): send baseSha to GateTest so enforcement scopes to the change #5622

Summary

• GateTest's unified verdict (gate-verdict.js, gatetest@3d917a95) scopes blocking enforcement to files the change touched — but only when the payload supplies a base SHA. Gluecron never sent one, so every push and merge-gate scan was whole-repo-enforced: a single pre-existing blocking finding anywhere in the tree failed everything.
• notifyGateTestOfPush now forwards post-receive's oldSha as baseSha (omitted on branch creation / all-zeros → GateTest honestly reports "base unknown").
• runAllGateChecks resolves the merge-base of base and head (base tip would misattribute base-side changes to the PR) and passes it to the blocking runGateTestScan; any resolution failure degrades to the previous whole-repo behavior.
• The field name baseSha is the pinned contract with the GateTest side (maps into scan_queue.base_sha).

Also audited (no code change needed): nothing in gate_runs consumers or notifications treats passed + non-zero issue count as impossible — status is authoritative, details is opaque JSON.

Test plan

• src/__tests__/gatetest-base-sha.test.ts — baseSha included for real SHAs, omitted for all-zeros and unknown, both async and blocking payloads (5 pass)
• Existing gate suites green (gate-gatetest-availability, green-ecosystem: 88 pass)
• bun build clean