fix(updates): scope commit drift to monorepo rootDirectory (#637)

[santhiprakash]

Summary

Fixes #637.

A monorepo project with its own rootDirectory was offered an unnecessary redeploy when other projects in the same repo changed. The drift tracker compared the deployed SHA against the repo-wide branch HEAD (latestSha) with no path scoping, so a commit that touched only a sibling directory still showed "Update available A → B".

When the project has a rootDirectory, the drift now computes "behind" from the GitHub compare of deployedSha..latestSha filtered to paths under that root (or a configured monorepo shared-path / root-config file). Uses the same leaf matching as the webhook and smart-route deploys so the update badge and deploy routing always agree on "affects this project".

Behavior

• Project with a rootDirectory whose committed diff is confined to a sibling directory → no spurious "Update available".
• File under the project's own root (or a shared-path / root-config file) → still reports drift.
• Path boundary disambiguation: apps/backend-utils/* does not match root apps/backend.
• Project without a scoping root (single-app repo) → unchanged behavior.
• Shared-path requires framework === "monorepo" — inert in single-app projects.

Conservative failure modes

The badge must never miss a real update because the network blinked:

• Missing ctx (background sweep can't reach GitHub): keeps behind as-is.
• Compare API failure / network error: keeps behind as-is.
• Truncated compare (≥ 300 files, GitHub's cap): keeps behind as-is.
• Empty file list: treated as not behind (SHAs differ but no changes visible).

Tests

• apps/api/src/modules/github/webhook-changed-files.test.ts — new unit tests for rootScopeAffected (10 cases).
• apps/api/test/modules/updates/drift-evaluation.test.ts — 10 new test cases for the monorepo scoping behavior in evaluateDrift, covering all the conservative-failure branches above.

All 26 drift-evaluation tests pass. No existing tests changed.

Verification

bun run --cwd apps/api lint (typecheck) clean.
bun x vitest run test/modules/updates/ — 38 passed (26 drift + 12 cache), 0 failed.
bun x vitest run src/modules/ — 974 passed, 0 failed (one unrelated gh-identity-health test failure pre-exists on main).

Diff

 apps/api/src/modules/github/webhook-changed-files.ts            | +27   (rootScopeAffected helper)
 apps/api/src/modules/github/webhook-changed-files.test.ts      | +79   (new test file)
 apps/api/src/modules/projects/project-crud.service.ts           | +48/-2 (evaluateDrift root scoping)
 apps/api/src/modules/updates/updates.service.ts                 | +2/-2 (pass ctx to evaluateDrift)
 apps/api/test/modules/updates/drift-evaluation.test.ts         | +147  (scoping tests)