fix(git): count a commit already on origin/<base> as the base's, not the branch's

[protonspy]

What changed

git.Commits measured "not on base" against refs/heads/<base> only. When local main lags origin/main (the usual state once PRs merge on the forge), a branch cut from origin/main claimed every lagging commit as its own, and the attribution validator blocked git push on a commit merged long before.

• Commits now runs git log HEAD --not <every existing copy of the base> — local and origin/<base>. On the base branch itself it still compares against the remote only.
• Changed (single-ref working-tree diff) uses the remote base when the local one is merely behind it; a diverged local base keeps the old answer.
• Look is unchanged (out of scope, see plan).

Plan: plans/attribution-stale-base.md

Verification

• New tests, each failing before the fix: TestCommitsIgnoreWhatOnlyTheRemoteBaseHas, TestChangedDiffsAgainstTheFresherBase, TestAttributionIgnoresWhatIsAlreadyOnTheRemoteBase.
• scc validate --checks --pr: build, format, lint, tests (1005, coverage 86.2%) — 0 findings.
• Reproduced on a real repo with local main 20 behind origin/main: installed scc validate reported attribution.co-authored-by on an already-merged commit; the fixed build reports no findings.

Reviews

• scc-code-review: clean, no findings.
• scc-security-review: clean, no findings. Refs are always built as refs/heads/… / refs/remotes/origin/… (no flag injection); the local check remains spoofable by anyone controlling their own refs, as before this change.