fix(sdk): warn when repository HEAD drifts

[Mr-Neutr0n]

Summary

• warn once while a scan is running when the registered Git HEAD changes
• cover clean repository, worktree, and working-tree diff scans without changing immutable ref behavior
• keep final target validation authoritative and include target_changed warning details

Fixes #164.

Verification

• focused monitor and SDK orchestration tests pass
• pnpm run types passes
• Prettier, diff, secret, burst, title, and repository-preflight checks pass
• the broader API suite has five existing environment failures on this host because /usr/bin/python3 is Python 3.9 and the host Node is v25, outside the repository test matrix

[ting-hong-shieh]

Reviewed at eae65c543150f3dfe1040de1a6a7fcad07801fda. The monitor is limited to mutable Git targets, warns once, treats transient HEAD-read failures as non-fatal, and leaves completion-time target validation authoritative.

Validation snapshot:

• Exact head: target-drift.test.ts 2/2; focused orchestration test 1/1; pnpm lint; pnpm format.
• Synthetic merge onto current main (2f785900d2cefb932cf97fb1d675491d14790839): clean merge; the same three focused tests, typecheck, formatting, and git diff --check pass.
• The broader API run is not part of this approval evidence: its five failures are host-environment failures under macOS /usr/bin/python3 3.9, while the focused exact-head and current-main checks above are clean.

No issues found.