Land the drift alarm's git-read cache from branch scout/6502-the-drift-alarm-reads-each-pull-s-distan, with the older tests as they are on main #6535

Replaces #6502. The work is done and the review called it sound three times (pull #6507, closed): the cache key is repository, base branch, head oid and main tip; an unreadable tip is never cached; eviction and the null-tip case are tested. What remained was scope.

Done:

• [ ] Branch scout/6502-the-drift-alarm-reads-each-pull-s-distan (head c5f47cb1) is brought up to date with main and opened as a new pull titled as this issue's outcome: the drift alarm reads git once per pull head and main tip, so a second reading with nothing moved starts no git process per pull.
• [ ] In test/flow-alarm-drift.test.ts, the older tests' commitToBranch lines are exactly as on main (the as any edits come out); the diff is the cache in src/flow/alarm_drift.ts and the new tests only.
• [ ] No timing claim in the title, body or tests.

Files: src/flow/alarm_drift.ts, test/flow-alarm-drift.test.ts.

Before pushing: bun x tsc --noEmit and bun test test/flow-alarm-drift.test.ts.