fix(ticket-083): isolate workspace comparison evidence

[tom-sapletta-com]

Makes compare-workspace observationally pure: the selected output owns extractor caches and existing generated evidence is excluded from the captured Git state.\n\nValidation: npm verify 421 pass, 1 JDK-only skip; Docker smoke and governance pass.

[ifuri-validator-agent]

Deterministic Validator approval for exact head 087ed6813facda063f3b514ad3c026edceadd346.

Ticket: ticket-083
Correlation ID: todo2code-pr-98-ticket-083
Model: zai/glm-5.3
Reviewed diff chunks: 2
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 2 diff chunk(s). Chunk 1 of ticket-083: documentation/governance scaffold (TODO, TICKETS index, ticket-083 metadata) plus the first half of src/comparison/workspace.ts changes. The status-snapshot change correctly excludes only the selected in-repository output directory using top-relative pathspec excludes, with proper guards for external/absolute paths. TICKETS.md adds a ticket-077 row while this is ticket-083 — a minor inconsistency, likely from chunking or index generation. No security issues; all reported checks pass. | Chunk 2 propagates outputDir into base/current pipeline configs so extractor caches follow the requested output directory, and extends workspace tests to assert ambient .intent is not created and repeated comparisons exclude existing evidence. Tests all pass.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Merge will be attempted after this approval when explicitly authorized.

Decision record (recomputable)

DECISION D-083-6435
TICKET ticket-083
HEAD_SHA 087ed6813facda063f3b514ad3c026edceadd346
CORRELATION_ID todo2code-pr-98-ticket-083
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["governance=SKIPPING","Live OpenRouter contract (opt-in)=SKIPPING","Java adapter (JDK 17 required)=PASS","verify=PASS","koru / code-review=PASS","verify=PASS","Java adapter (JDK 17 required)=PASS"]
INPUT required_checks = ["verify","Java adapter (JDK 17 required)","koru / code-review"]
INPUT required_checks_source = "protected registry + GitHub applied rules (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "zai/glm-5.3"
ASSERT VERDICT_AUTHORITY != "ADVISORY"