fix(constraints): floor-guard reference reads hunk lines as content and runs from the top

Two follow-ups from the review on #600, both already on main before it:

- The diff walk treated any line starting with `---` or `+++` as a file
  header. Inside a hunk those lines are content. An added line that starts
  with `++` (`++n; // eslint-disable-line no-plusplus`) shows as `+++n; ...`
  and was dropped, so the suppression passed. An added line that starts with
  `++ ` was taken as a header, so the lines after it were filed under a
  made-up path and a removed assertion further down the same test file went
  unreported. A removed line starting with `--` never reached the removed
  list either. Headers are now read only between a file's `diff` line and
  its first `@@`.
- Run from a subfolder, `git ls-files --others` listed only that
  subfolder's untracked files, relative to it, while `git diff` covers the
  whole tree from the top. An untracked suppression elsewhere in the
  repository was missed, and one inside the subfolder was reported under a
  different name from the tracked files. The guard now changes to
  `git rev-parse --show-toplevel` first, and exits 2 outside a work tree.

The test gains six cases: five fail on main, and the sixth (outside a work
tree) passes on both and covers the new exit-2 path; 28 pass. The test now
also runs in the macOS/Windows matrix.

.github/workflows/test-plugin-install.yml

@@ -99,6 +99,7 @@ jobs:
           scripts/validate-reference-links-test.js
           scripts/validate-commands-test.js
           scripts/validate-artifact-paths-test.js
+          scripts/floor-guard-reference-test.js
 
       - name: Validate all skills
         run: node scripts/validate-skills.js