fix(core-change-watch): report bounded history coverage accurately

[Garfielk]

Summary

Fix defect 1 in #195: bounded Git history must not report unproven time-window coverage as ready.

git log -(maxCommits + 1)
  first maxCommits -> hotspot statistics
  one extra commit -> coverage evidence only

history-window-coverage is ready only when every requested window has complete coverage and scoped commits were observed. Capped, unknown, skipped, or empty history requires review.

Why

• Issue/Story: [Bug]: 4 project-harness analysis defects — history windows collapse, instruction-surface misclassification, project gates invisible, Rules surface missing #195, defect 1 only.
• User or maintainer outcome: Prevent truncated windows from being presented as independent evidence of sustained or legacy activity; report the coverage boundary supported by accessible Git history.

Traceability and Scope

• Spec/ADR, if applicable: docs/specs/2026-10-15-195-history-window-coverage.md.
• Acceptance criteria addressed: AC-1 through AC-5: truncation, history exactly at the cap, non-monotonic timestamps, shallow repositories, empty/skipped history, custom windows, Git scope, file/language filters, and zero-observation wording.
• Canonical owners changed: scripts/core-change-watch/git-history-profile.mjs, scripts/core-change-watch/evidence-pack.mjs, test/governance/core-change-watch.test.mjs, and references/project-harness/core-change-watch.md.
• Explicit non-goals: Other defects in [Bug]: 4 project-harness analysis defects — history windows collapse, instruction-surface misclassification, project gates invisible, Rules surface missing #195; fetching or deepening history; unbounded scans; reconstructing omitted hotspots; changes to the existing recovery case-study PR; new dependencies, CLI options, UI, or release metadata.

Change Type

• Feature
• Bug fix
• Tests only
• Documentation/community
• Refactor with no intended behavior change
• Dependency, packaging, or infrastructure

Test and Review Evidence

Checks ran on macOS using Node.js v24.21.0.

Check	Result
mise exec node@24.21.0 -- npx vitest run test/governance/core-change-watch.test.mjs	34/34 passed; real-Git regressions failed before the fix and passed afterward.
mise exec node@24.21.0 -- npm test -- --maxWorkers=4	119 files passed, 1 skipped; 1789 tests passed, 7 skipped.
mise exec node@24.21.0 -- npx vitest run test/skills-docs/doc-link-graph.test.mjs	8/8 passed; routing graph unchanged.
mise exec node@24.21.0 -- npm run pack:verify	Passed: 747 npm entries, 1008 runtime ZIP entries.
git diff --check	Passed.
Independent AI Standards, Spec, and complexity reviews	No remaining actionable findings; follow-up review confirmed the P2 wording issue was fixed.

Manual or visual evidence: A real temporary Git repository returned [unknown, capped, capped] and review with cap=3; a complete scan returned complete coverage and ready. Zero-count capped/unknown windows describe only the analyzed sample. No UI changes. Windows/Linux execution was not tested. Earlier unsuccessful full-suite attempts and their environment/timing failures are recorded in the spec; the passing full-suite result above used physical local dependencies and four workers.

Risk and Recovery

• Compatibility and cross-platform impact: Adds history-profile coverage metadata and preserves existing fields and trend labels. Git execution uses argv arrays and portable paths. macOS was tested; Windows/Linux execution remains unverified.
• Package, plugin, schema, or generated-file impact: No new dependencies; routing graph unchanged; package/runtime verification passed.
• Rollback or recovery path: Revert commit ab797ff to restore the previous implementation and remove its associated tests/spec changes.
• Residual risk or unverified boundary: Shallow history, non-monotonic dates, and commits beyond the cap can only support conservative unknown/capped results. Accessible local history does not prove remote completeness.

AI Involvement

• Level: Generated. Codex implemented the change; independent AI reviewers checked standards, requirements, and complexity.
• Human review and validation: The contributor authorized submission. No independent human technical acceptance or Windows/Linux execution is claimed.

Checklist

• I followed AGENTS.md, CONTRIBUTING.md, and the relevant canonical-owner guidance.
• The change is focused and does not include unrelated local or generated state.
• Tests and documentation match the behavior actually delivered.
• Markdown links were checked when documentation moved or changed.
• Cross-platform behavior was considered for Windows, macOS, and Linux.
• Package/runtime verification was run when shipped files or dependencies changed.
• User-facing or compatibility changes are recorded in CHANGELOG.md. Release metadata was excluded by the accepted spec and the scope rule in AGENTS.md; this PR records the output-contract change and validation evidence.
• I have the right to contribute this work under the repository's MIT License.

Evidence

• Before: The real-Git fixture incorrectly reported truncated windows as ready; a zero-count window could imply no commits existed in unscanned history.
• After: Both regressions pass. Coverage controls readiness, and zero-count wording explicitly refers to the analyzed sample.

Merge Danger

Door: two-way

Reversible as one commit. Bounded or shallow history can change an optimistic ready result to review.

Blast Radius: core-change-watch