Implement Step2: practical level

[hidetzu]

Summary

• Add hotspot detection, test change detection, security/core module signals
• Per-file risk scoring for AI and reviewer consumption
• Exit code reflects risk level

Related Spec

• specs/usecases.md
• specs/requirements.md
• specs/spec.md (updated git.Log signature)
• specs/roadmap.md

Roadmap Step

• Step1: Minimal Working Version
• Step2: Practical Level
• Step3: Team Customization

Changes

• internal/git: Add Log() method with FileChangeCount return type
• internal/signal: S-4 hotspot (90 days, 5+ changes), S-5 no_test_change (multi-language patterns), S-6 core_module, S-7 security_module
• internal/analyzer: Signal dedup — security_module takes priority over core_module
• internal/scorer: Per-file risk calculation (min(file_weight_sum / 40.0, 1.0))
• internal/formatter: JSON/text output includes files[] with per-file risk and signals
• cmd/root.go: Wire new signals, sentinel error for exit code
• main.go: Exit code 0 (low), 1 (medium+), 2 (error)
• specs/spec.md: Updated git.Client.Log signature to match implementation

Design Decisions

• Hotspot: last 90 days, 5+ changes (time-based is more explainable than commit-based)
• no_test_change: aggregate signal, no per-file production-test pairing in Step2
• security > core priority: avoid double counting, auth-related paths treated as security
• Per-file risk: file-scoped signals only, aggregate signals excluded

Test Plan

• Unit tests added (50 tests across all packages)
• Exit criteria verified:
  • Hotspot files detected from git history
  • Missing test changes flagged
  • JSON output includes files[] with per-file risk and signals
  • Exit code reflects risk level