check-for-epoch-bump: enforce epoch bump when package moves between dirs

[xnox]

Summary

• When a package is moved between os/, enterprise-packages/, and extra-packages/, the script now tries all three candidate paths on main to find the previous version/epoch.
• Previously, a moved package would appear as brand-new (version 0 / epoch 0) so the bump check was silently skipped.
• Falls back to the original single-path lookup for files outside those three directories.

Test plan

• Modify a file under os/ with the same version/epoch — confirm warning is emitted
• Move a package from enterprise-packages/foo/foo.yaml to os/foo/foo.yaml without bumping epoch — confirm warning is emitted
• Move a package and bump the epoch — confirm check passes

🤖 Generated with Claude Code

[dustinkirkland]

Hmm, there is a lint error:

Error: The action actions/cache@v4 is not allowed in chainguard-dev/pre-commit-hooks because all actions must be pinned to a full-length commit SHA.

[xnox]

Hmm, there is a lint error:

Error: The action actions/cache@v4 is not allowed in chainguard-dev/pre-commit-hooks because all actions must be pinned to a full-length commit SHA.

Filed:

• pre-commit/action cannot be used in repositories requiring all actions to be pinned by digest pre-commit/pre-commit#3672