ci: add read-only shared dependency impact report

[Pigbibi]

Summary

• Add an advisory contents:read PR workflow resolving exact base/head shared-dependency SHAs from pyproject.toml and uv.lock.
• Fetch only fixed upstream repositories at exact SHAs and report full Git tree-diff paths, separated into production, docs, tests, and CI; flag authentication/token refresh, possible cloud/secret writes, execution, risk, and scheduler/automation paths.
• Explicitly report incomplete evidence, unknown dynamic behavior, and normal startup refresh reachability; report success is not an upgrade-safety verdict.
• No runtime/dependency pin/authentication changes, token refresh, secrets, deployment, approvals, merging, or changes to refactor(b12): decision_mapper → QPK semantics/display facade (parity-tested; draft: QPK #653 auth delta) #589.

Verification

• Full local suite: 1967 passed, 176 subtests passed (2 existing deprecation warnings).
• Twelve offline report tests cover historical 350dd38→155d74a auth/facade fixture, mismatched/missing pins, compare failure/truncation, overflow, renamed/deleted/hostile/non-UTF-8 paths, and alternate dependency declarations.
• Full ruff, uv lock --check, bounded deployment workflow shell tests, and git diff --check passed.
• Live read-only fixed-URL exact-SHA upstream fetch/diff verified 51 changed paths, including 25 production/other paths and authentication changes, for 350dd38→155d74a.
• Independent review findings addressed: Markdown path escaping, final summary bound, normalized dependency declarations, lossless path handling. Final workflow logging separately checked against command-injection filenames.
• Final head 8b8237da46c2447c639b91e088fd64c5db121ab7: CI succeeded; advisory report succeeded.
• Hosted report contents verified in logs: all three dependency pins unchanged. This validates the no-change path, not a hosted dependency-upgrade comparison or approval.

Limitations

Fixed path rules are conservative review hints, not semantic reachability proof. Private upstream/fork access failures yield INCOMPLETE with no additional credentials. Existing test/pin/lock gates remain unchanged. This remains a draft for review.