chore(scripts): add index-metrics, pr-guard and probe rows; merge CHANGELOG with union

[bompus]

The upstream-merge updater for this fork runs from a separate host-configuration repo. Some of its code is about this repository, not the host: graph metrics, a lockfile rule for upstream PRs, the explore probe, and a CHANGELOG conflict resolver. This PR moves that code here. The updater will call these scripts once this lands.

Changes

• scripts/index-metrics.mjs <a.db> [b.db] [--labels a,b] prints graph counts: nodes, edges, self-calls, interface members, import-to-member edges, initializer calls and resolvedBy totals. With two indexes it adds a one-line delta and a call-edge diff keyed on (source, target, refName) by qualified name, with multiplicities. An edit that only shifts lines does not show up as a lost edge. diff-index-drift.mjs stays separate: it compares a synced index against a rebuild of the same tree, keyed on node ids.
• scripts/pr-guard.mjs [--base upstream/main] [--allow path] fails when the current branch adds bun.lock, bun.lockb, yarn.lock or pnpm-lock.yaml at any depth. Upstream tracks only package-lock.json. A stray bun.lock reached upstream feat(explore): markdown index (#361) with a section-first doc tier colbymchenry/codegraph#1699 before this check existed.
• scripts/agent-eval/probe-explore.mjs:
  • The positional form still prints the answer.
  • The old Excalidraw-specific stats are replaced by --expect <regex>, which reports where each pattern first matches and exits 1 when one is missing.
  • --tasks <file> [--ids globs] --out <dir> prints one JSON row per task: ms, chars, sourceAt, files and mustMatchAt. A final memory row follows, and each answer is saved as <id>.md.
  • --mcp [--runtime <path>] asks a serve --mcp subprocess instead of the in-process handler.
  • --build <dir> points at another checkout's dist/.
  • The row format is a contract: the updater's promotion gate reads sourceAt and mustMatchAt.
• .gitattributes: CHANGELOG.md merge=union. Upstream and the fork both append bullets under the same headings. Git now keeps both sides instead of stopping the merge.
• Docs: rows in the dynamic-dispatch playbook tool table, and a paragraph in the codegraph-build-validation skill.

Verification

• New __tests__/fork-tooling-scripts.test.ts (13 tests). It covers the metrics against a real node:sqlite index, the edge diff, the lockfile rule, probe rows and task globs. It also runs the MCP mode against a fixture server for timeouts, a server exit, an RPC error, a tool error and success, and checks that the server is reaped each time.
• Real runs on gin:
  • Positional form with --expect (a present pattern at offset 2464; a missing one gives exit 1).
  • --tasks in-process on Node.
  • --mcp served on Bun, and on Node from a Bun-run script. Rows match across modes.
• index-metrics.mjs on the zod upstream/fork indexes from the precision replay: import-resolved 1399 -> 5320, with the diff listed. A missing file gives exit 2 without creating it.
• Union merge in a scratch repo: two branches adding different bullets under one heading merge cleanly with both kept.
• Full suite on Node 24.21.0: 376 files, 6,240 passed, 34 skipped.

README rows checked: none apply. These are maintainer scripts, not user-visible features, and no measured number moves.