feat(governance): threshold-change flagging — the Goodhart guard (G6/G7) - #24

What

--baseline-config PATH on agentdiff diff. When gate values in the baseline's agentdiff.toml differ from this run's, the PR report renders a [!WARNING] block above the gate table: max_divergence: 0.25 → 0.40 — right next to the diff it let through.

Why

G6/G7 from the release plan (0.4.0 Honest Gate). A threshold tuned until CI goes green stops being a control — this makes loosening the gate as reviewable as the code it guards. Directly answers the Goodhart critique (see blog).

How

• governance.py: diff_gate_thresholds() compares effective gate values (config-or-default) for max_divergence, max_loops, max_cost_delta, max_recovery_ratio
• CLI diff --baseline-config: PR format renders the warning; --explain prints the same summary; missing file exits 2
• agentdiff-check action: new baseline-config input — CI one-liner git show origin/main:agentdiff.toml > /tmp/baseline-agentdiff.toml
• Docs: "Gate governance (Goodhart guard)" section in the Configuration guide + README flag reference

Testing

• 14 new tests (333 total green): detection (loosened/tightened/none→value), PR warning placement + renders even when passing, CLI wiring, missing-file exit code
• Manual end-to-end: old config (0.2/10.0) vs new (0.5/25.0) → warning lists both changes in pr and explain formats

Checklist

• One logical change
• Lint + tests green (333)
• Docs + action input wired