Write scope enforcement guardrail

[jdelfino]

Write the scope enforcement guardrail check.

File

.github/workflows/guardrail-scope.yml

What

• Trigger: PR opened or synchronized
• Compare files changed in PR against files listed in the linked issue body
• Parse fixes #N → read issue #N body → extract file paths mentioned
• If extra files changed: report action_required with annotations
• Check for non-stale PR approval override → report success if approved

Reference

• docs/design.md: Scope Enforcement (Layer 4)