feat: baseline mode + touched-line enforcement

[aidenybai]

Second of a three-PR split of #286. Stacked on #287 (cursor/config-foundation-675b) — review and merge that one first.

Both features in this PR are scan-time filters that combine with diff mode. They share enough infrastructure (InspectResult/JsonReport extensions, inspect.ts, action.yml inputs, the validate-config-types schema additions) that splitting them further would create awkward dependencies.

Baseline mode — --baseline / --update-baseline

react-doctor . --update-baseline               # snapshot current diagnostics
react-doctor . --baseline                      # only new violations count
react-doctor . --baseline=./qa-baseline.json   # custom path

• Stable per-diagnostic fingerprint: plugin + rule + filepath + message. Line/column intentionally excluded so unrelated edits don't break the baseline.
• Baseline counts surface in InspectResult.baselineDiagnostics, JsonReport.summary.baselineDiagnosticCount, and PR comment framing ("9 baseline issues — no new violations introduced by this PR").
• Empty-string path falls through to DEFAULT_BASELINE_FILENAME (regression test included).

Touched-line enforcement — --touched-lines

react-doctor . --diff main --touched-lines     # gate PR-time on touched lines only
react-doctor . --staged --touched-lines        # pre-commit hook variant

• Parses git diff --unified=0 to filter diagnostics by line.
• DiffInfo.diffBaseRef exposes the right git ref for each diff shape; current-changes mode uses HEAD (not null) so staged-only changes aren't silently dropped by the touched-lines filter.
• Hidden-by-touched-lines counts surface in JsonReportProjectEntry.diagnosticsHiddenByTouchedLines.
• Robust against unified-diff content lines that begin with "-- " (e.g. SQL comments) — FILE_HEADER_RESET_PATTERN only resets on real --- a/<path> or --- /dev/null headers.

action.yml

Adds the baseline and touched-lines inputs alongside main's annotations input. Preserves the existing PIPESTATUS / set +e exit-code preservation around the scan pipeline.

Stats

• 25 new tests across the baseline and get-touched-lines suites, plus the build-json-report summary contract.
• All 1217 tests passing; lint / typecheck / format clean.

What's NOT in this PR

• PR comment markdown / sticky comment integration — in stacked PR 3.

Originally landed as part of #286.

  

[reactreview]

🔴 No new issues

0/100 (unchanged)

^{Reviewed by react-review for commit dd93a69. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
react-doctor-website	Ready	Preview, Comment	May 17, 2026 0:15am

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a9c3e64. Configure here.}