feat: add v0.6 cross-source evidence compare

[yaertu]

🎯 Kullanıcı sonucu

İki FixBundle artifact'ı ver, integrity doğrulandıktan sonra deterministic what changed? raporu al.

fixbundle compare baseline.zip incident.zip
fixbundle compare baseline.zip incident.zip --format json

🔧 Değişiklik

• fixbundle compare text + stable JSON output
• fixbundle/0.3, 0.4, 0.5 input normalization
• local↔local, GitHub↔GitHub ve GitHub↔OTLP evidence comparison
• commit / changed-file / failed-command / job / step / exception / service / trace / runtime drift
• deterministic changed, added, removed, unavailable semantics
• real OTLP baseline→incident compare demo
• version/package/docs sync to v0.6.0

🔒 Integrity / hostile ZIP boundary

Compare evidence'i yorumlamadan önce SHA256SUMS.txt doğrular. Exact checksum coverage gerekir. Absolute/drive/traversal/backslash/NUL paths, duplicate members, symlinks, encrypted members, checksum mismatch, unknown schema ve archive size/member limit ihlalleri fail-closed olur. Input ZIP extract veya mutate edilmez. Compare core network/LLM istemez.

🧪 Kanıt

• local↔local test
• GitHub↔GitHub test
• GitHub↔OTLP test
• checksum tamper regression
• path traversal regression
• duplicate member regression
• symlink regression
• unsupported schema regression
• real CLI JSON subprocess test
• invalid ZIP CLI fail-closed test
• reproducible scripts/demo_compare.py
• historical demo preserved
• OTLP production demo preserved
• live GitHub failure evidence preserved
• pre-release compare gate run 33591450004: 10/10 PASS
• final release-tree PR CI 33591771123 on 9082cf792fca5cfdda3d03f3e7394824a641fa1d: 10/10 PASS
• post-merge main 10/10 proof

Closes #6 only after post-merge main proof passes.

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing