fix(ci): diff-scope the no-major changeset guard against the merge base (#7005) (#7048)

`check-changeset-no-major.mjs` read the whole `.changeset` directory with no
branch point, so its verdict was a function of what main carried rather than of
what the author wrote. Dormant while pre-mode holds; at `changeset pre exit` it
would have failed every unlabelled PR in the repo, each listing 172 pending
major changesets it never touched, with `allow-major` as the only route out.

Judge only what the diff introduces, starting at `merge-base(base, head)` —
the machinery `check-empty-changeset.mjs` already carries for #6129, reused
rather than reinvented. The pending stock is exempt with no roster.


Claude-Session: https://claude.ai/code/session_01F8q5J1MQyocgtNspb15fSn

Co-authored-by: os-dev <dev@objectstack.ai>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: 3 people

.github/workflows/pr-automation.yml

@@ -822,8 +822,21 @@ jobs:
         # never the event payload. Its comment block carries the argument: what the
         # payload read cost, where this diverges from #5580's `skip-changeset` read
         # and why, the residual it leaves, and what re-arms the whole thing.
+        #
+        # `--base` takes the same merge base the two gates above take, for the
+        # same #6129 reason one defect along (#7005). This script used to read
+        # the whole `.changeset` directory with no branch point, so its verdict
+        # was a function of what main carried rather than of what the author
+        # wrote. That was invisible while pre-mode held and would have become
+        # visible all at once at `changeset pre exit`: 171 consumed-but-undeleted
+        # major changesets sit on main until the post-exit `changeset version`
+        # removes them, so every unlabelled PR open in that window would have
+        # gone red listing files it never touched, with `allow-major` -- a label
+        # meaning "a whole-stack major is intended HERE" -- as its only way out.
         if: >-
           steps.labels.outputs.skip != 'true'
           && steps.labels_settled.outputs.skip != 'true'
           && steps.allow_major.outputs.allow != 'true'
-        run: node scripts/check-changeset-no-major.mjs
+        env:
+          MERGE_BASE: ${{ steps.diffbase.outputs.merge_base }}
+        run: node scripts/check-changeset-no-major.mjs --base "$MERGE_BASE"