fix(ci): pass changed files to the self-heal reconcile check and companion

[joshua-temple]

Problem

cascade's own self-heal reconcile wiring never received changed files, so it always no-op'd. .github/workflows/pr.yaml ran cascade reconcile --check and .github/workflows/pin-reconcile.yaml ran cascade reconcile --own-repo with no changed-file arguments. cascade reconcile reads governed pin bumps from files passed via repeated --changed-file <path> flags; with none, it scans nothing and always reports relevant=false, so the companion never actually reconciled. Caught by the intentional-trip proof.

Fix

Mirror the already-correct emitted user template (internal/generate/reconcile_companion.go). Both hand-authored workflows now compute a git diff --name-only of the PR's changed governed source files and pass each as --changed-file:

• pr.yaml detector: deepen the checkout to full history, diff base..head over .github/workflows/ AND .github/actions/ (cascade's own governed sources include composite actions), pass --changed-file and write the artifact via --check-output pin-reconcile-result.json. Still advisory (non-gating).
• pin-reconcile.yaml companion: surface base_sha from the resolved PR metadata, compute the same changed-file set, and thread --changed-file into cascade reconcile --own-repo. No security property changed (pinned binary, state-token push, fork guard, loop guards, metadata-only PR resolution all intact).

No generator or Go changes; the emitted templates were already correct. No release needed.

Verification

• actionlint (with shellcheck) clean on both files; PR SHAs routed through env and quoted.
• go build ./... clean (no Go changed).
• Follow-up: an intentional-trip proof to confirm the detector and companion now report relevant and reconcile.