feat(cli): stacked-push verify walker via --from

[chtnnh]

Summary

• Add know-code verify --from <oid>: walk from..HEAD, split by Know-Code-Verified hash, and check each run as a historical tree-pair (parent-of-first → tip). Trailerless merges attach; trailerless linear commits fail closed. One-non-merge runs also accept the empty-tree (index) hash; later pushes in the same range match first-parent ancestors of the run start.
• Wire this repo’s workflow, know-code init --workflow, and the composite action to run on push to the base branch and pass github.event.before. PR verify is unchanged (head.sha, no --from). All-zeros before skips the walk.
• Lock GitHub-shaped verify behavior in local git fixtures (dummy origin, no network) and document the push walk, including the receipt-mode vs rewrite caveat.

Fixes #10.

Test plan

• npm test — especially verify-walk.test.ts and the GitHub-shaped cases in verify.test.ts
• On this PR: job checks out head.sha and runs bare know-code verify
• After land: a push to main runs know-code verify --from "$BEFORE" (skip if before is all zeros)
• Confirm a tip-only receipt landed as a merge commit would fail the push walk (documented); default squash / rewrite can pass

[cursor]

PR Summary

Medium Risk
Changes security-sensitive CI verification and new fail-closed rules on push (stricter than PR scan); misconfigured before or receipt-only tip trailers can break main after merge.

Overview
Enables CI trailer verification after merges land on the default branch, where bare know-code verify could not run because HEAD equals the base with no merge-base range.

The CLI gains know-code verify --from <oid>, which walks from..HEAD, groups commits into runs by Know-Code-Verified hash, and checks each run against historical tree-pair hashes (computeTreePairHash from commit trees, not live write-tree). Trailerless merges attach to the current run; linear commits without trailers fail closed. Hashing uses the last non-merge in a run so GitHub merge commits still match after main moved.

GitHub integration now triggers verify on push to the base branch as well as pull_request: checkout uses head.sha || github.sha, and push jobs pass github.event.before as --from (all-zeros before skips the walk). init --workflow, the monorepo workflow, and the composite action from input follow the same pattern.

Docs and tests document the PR vs push split, merge-button behavior, and receipt-mode push caveats; smoke CI adds a --from HEAD^ check.

^{Reviewed by Cursor Bugbot for commit b50c9b2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 860d5b6. Configure here.}