feat(merge-report): add Ports: <sha> trailer detection layer

[jfallows]

Summary

Adds a new deterministic detection layer to merge-report for the one false-positive shape none of the existing heuristics can resolve: a port whose content is a deliberate subset or superset of the original commit (e.g. the original bundled an unrelated version bump that the target branch's own version already covers). That kind of divergence changes both the patch-id and the subject enough that neither git cherry nor subject-match can recognize the pairing — discovered in practice on aklivity/zilla-plus, where PR #1053 ported command-logs from support/1.x but deliberately dropped the zilla.version bump the original commit bundled, since develop's version already covered it.

• A target-branch commit can now carry a Ports: <sha> line in its body (full or abbreviated sha, same convention git log <prefix> accepts), asserting it carries forward a specific source-branch commit.
• Unlike subject-match, this is a human assertion, not a heuristic — trusted outright, no file-overlap confirmation needed.
• Checked right after the label/ignore-list lookups (cheap in-memory check), since trailer values are scanned once per target branch up front rather than once per candidate.
• On by default (ports-trailer: true); configurable via .gitflow-changelog.yml, the CLI (--ports-trailer), and the action (ports-trailer input) — same override precedence as subject-match.

New files

• src/ports-trailer.ts — pure trailer parsing (parsePortsTrailers) and matching (portsTrailerMatches) logic, unit tested without a git fixture.
• src/git.ts — scanPortsTrailers(ref, options), a single history walk collecting every Ports: trailer value reachable from ref.

Test plan

• npm run typecheck
• npm test — 235 passing (19 new: 13 in test/ports-trailer.test.ts, 2 in test/git-cherry.test.ts, 4 end-to-end in test/merge-report.test.ts)
• npm run build

---

Generated by Claude Code