Phase E — append-only memory + diff subcommand (PROMPT.md complete)

Closes the harness's feature set per PROMPT.md modes 2 (Diff Review)
and Phase 5 (Memory). Rules subcommand still pending (it needs
operator-authored .review-rules.md content first; documented as
Phase E follow-up).

internal/memory/ — append-only writer:
- AppendKnownRisks: one JSONL line per confirmed finding per run.
  O_APPEND only; never O_TRUNC. Empty findings list is a no-op
  (doesn't even create the file — keeps clean runs from polluting
  .memory/).
- AppendRunHistory: one JSONL line per run. Run summary stats +
  receipts hash for cross-link.
- WriteProjectProfile: the ONLY non-versioned memory file; snapshot
  semantics, overwrites are explicit + documented.
- 4 unit tests including TestAppendKnownRisks_NeverTruncates which
  is the audit's "no silent overwrite" gate — write twice, assert
  both writes' content survives.

Pipeline phase 5 wires it. Confirmed findings only — suspected
findings might still be wrong, keeping .memory/ authoritative.
Disabled if review-profile.memory.enabled = false.

internal/git/git.go — ChangedFiles helper:
- Probes unstaged + staged + branch diff against main/master.
- Dedup'd, stable order. Empty result on clean tree.
- Graceful failure: returns error if git binary missing or target
  isn't a git repo.

cli/repo.go — Diff subcommand:
- `review-harness diff <path>` runs the same pipeline as scrum but
  scoped to changed files only. Pipeline.Inputs gains DiffOnlyFiles
  filter applied post-Walk.
- Empty diff (clean tree, no commits ahead of base) → exit 0 with
  message; doesn't generate empty reports.
- LLM toggleable via --enable-llm same as scrum.

scanner/walk.go: added .memory to SkipDirs (universal — harness's
own audit trail, scanning it surfaces planted-secret evidence as
new findings — same class as B5 self-skip).

.gitignore tightened: /.memory/ → **/.memory/ to keep test-fixture
.memory dirs from leaking into version control (same fix as
reports/latest pattern).

Verified end-to-end:
- 4 memory unit tests PASS
- Append-only proven: insecure-repo run 1 → 16 known-risks lines;
  run 2 → 44 lines (16 + 28 from new run); run-history grew 1 → 2.
- Diff subcommand against this repo (5 uncommitted Phase E files
  staged) → exit 0, all reports produced, scoped to those 5 files
  only (0 findings on the diff-scoped scan vs 129 on full repo —
  changed files don't contain analyzer-flaggable patterns).

Phase A through E shipped today. Rules subcommand + tests for
internal/{config,scanner,git,llm,reporters,pipeline} remain.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/git/git.go

@@ -6,6 +6,7 @@ package git
 
 import (
 	"context"
+	"fmt"
 	"os/exec"
 	"path/filepath"
 	"strings"
@@ -64,3 +65,61 @@ func runGit(ctx context.Context, dir string, args ...string) string {
 	}
 	return strings.TrimSpace(string(out))
 }
+
+// ChangedFiles returns the set of repo-relative paths the diff
+// subcommand should scan. Includes (in priority order):
+//   - unstaged changes (`git diff --name-only`)
+//   - staged changes (`git diff --cached --name-only`)
+//   - branch diff against base (`git diff --name-only base..HEAD`)
+//
+// base is auto-detected: prefer "main" then "master" then HEAD~1.
+// Returns dedup'd, stable-ordered list. Empty list when there's
+// nothing to review (clean tree, no commits ahead of base).
+func ChangedFiles(ctx context.Context, repoPath string) ([]string, error) {
+	if _, err := exec.LookPath("git"); err != nil {
+		return nil, fmt.Errorf("git not in PATH")
+	}
+	abs, _ := filepath.Abs(repoPath)
+	cctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	if err := exec.CommandContext(cctx, "git", "-C", abs, "rev-parse", "--git-dir").Run(); err != nil {
+		return nil, fmt.Errorf("not a git repository: %s", repoPath)
+	}
+
+	seen := map[string]bool{}
+	var out []string
+	add := func(s string) {
+		s = strings.TrimSpace(s)
+		if s == "" || seen[s] {
+			return
+		}
+		seen[s] = true
+		out = append(out, s)
+	}
+
+	// Unstaged
+	for _, line := range strings.Split(runGit(ctx, abs, "diff", "--name-only"), "\n") {
+		add(line)
+	}
+	// Staged
+	for _, line := range strings.Split(runGit(ctx, abs, "diff", "--cached", "--name-only"), "\n") {
+		add(line)
+	}
+	// vs base — try main, master, then HEAD~1
+	for _, base := range []string{"main", "master"} {
+		if runGit(ctx, abs, "rev-parse", "--verify", base) != "" {
+			for _, line := range strings.Split(runGit(ctx, abs, "diff", "--name-only", base+"...HEAD"), "\n") {
+				add(line)
+			}
+			break
+		}
+	}
+
+	return out, nil
+}
+
+// fmt + filepath are already imported indirectly; this var keeps
+// the import list clean if those packages get unused after a refactor.
+var _ = fmt.Sprintf
+var _ = filepath.Join
+