fix(governance): validate rebased push ranges

[Malakof]

Summary

• resolve push commit ranges inside the governed validator instead of assuming before remains reachable
• validate a rebased feature branch from its current default-branch merge base through the pushed head
• fail closed on non-fast-forward default-branch updates
• cover new, fast-forward, rebased, missing-head, and forced-default cases

Context

Rebasing crystal-capabilities#7 and pushing with --force-with-lease made the shared push workflow call git log d31b922..e472216, even though the old head was no longer reachable in the hosted checkout. Run 29310602567 failed with exit 128 before validating any commit; the same-head PR check passed.

Acceptance criteria

• Fast-forward pushes retain incremental before..after validation.
• Rebased feature branches validate the complete current branch delta.
• Forced default-branch updates fail explicitly.
• New branches retain the existing PR-owned validation contract.
• No retry, delay, timeout, or validation relaxation is added.

Validation

• python3 -m py_compile scripts/validate_commit_messages.py tests/test_governance.py
• python3 -m unittest -v tests/test_governance.py — 16 passed
• exact d31b922… -> e472216… capabilities case — 3 non-merge commits validated
• same exact graph with ref-name=main — explicit fail-closed error
• git diff --check

Tracking: Malakof/crystal-platform#412.