fix: use three-dot diff for scope drift detection in /review

The scope drift step (Step 1.5) used `git diff origin/<base> --stat`
(two-dot), which shows the full tree difference between the branch tip
and the base ref. On rebased branches this includes commits already on
the base branch, producing false-positive "scope drift" findings for
changes the author did not introduce.

Switch to `git diff origin/<base>...HEAD --stat` (three-dot / merge-base
diff), which shows only changes introduced on the feature branch. This
matches what /ship already uses for its line-count stat.

review/SKILL.md

@@ -195,7 +195,7 @@ Before reviewing code quality, check: **did they build what was requested — no
    Read commit messages (`git log origin/<base>..HEAD --oneline`).
    **If no PR exists:** rely on commit messages and TODOS.md for stated intent — this is the common case since /review runs before /ship creates the PR.
 2. Identify the **stated intent** — what was this branch supposed to accomplish?
-3. Run `git diff origin/<base> --stat` and compare the files changed against the stated intent.
+3. Run `git diff origin/<base>...HEAD --stat` and compare the files changed against the stated intent.
 4. Evaluate with skepticism:
 
    **SCOPE CREEP detection:**

review/SKILL.md.tmpl

@@ -42,7 +42,7 @@ Before reviewing code quality, check: **did they build what was requested — no
    Read commit messages (`git log origin/<base>..HEAD --oneline`).
    **If no PR exists:** rely on commit messages and TODOS.md for stated intent — this is the common case since /review runs before /ship creates the PR.
 2. Identify the **stated intent** — what was this branch supposed to accomplish?
-3. Run `git diff origin/<base> --stat` and compare the files changed against the stated intent.
+3. Run `git diff origin/<base>...HEAD --stat` and compare the files changed against the stated intent.
 4. Evaluate with skepticism:
 
    **SCOPE CREEP detection:**