feat: add diff regression guard

[Bakobiibizo]

What changed

• add dev guard, a fast merge-base diff scanner for repository-owned regex and path rules
• report every finding as a concise summary or GitHub annotation, with detailed evidence available on demand
• load policy from the base revision so proposed changes cannot weaken their own gate
• add a low-noise devkit policy, CI gate, documentation, and regression tests
• bump devkit and devkit-cli from 0.4.0 to 0.5.0

Why

This catches newly introduced skipped work and high-signal failure-suppression patterns without reporting legacy code or dumping noisy build output into model context.

Validation

• cargo fmt --all -- --check
• cargo test --workspace --all-targets
• cargo clippy --workspace --all-targets -- -D warnings
• cargo build -p devkit-cli --release
• sh -n scripts/install.sh
• target/release/dev guard --base origin/main --format github

The workspace-wide release build also exposed the repository's pre-existing duplicate dev binary output collision on the mounted filesystem; the published devkit-cli release package builds successfully.