feat(ci): add PR architectural impact analysis (#733)

[diberry]

Summary

Phase 1 MVP of automated PR architectural impact analysis (issue #733).

What's included

• *\scripts/analyze-impact.mjs* — main analysis engine that uses \gh\ CLI to fetch PR data, maps changed files to modules, and calculates a risk tier
• *\scripts/impact-utils/* — modular utilities:
  • \parse-diff.mjs\ — parses diff output into structured file data
  • 
    isk-scorer.mjs\ — calculates risk tier (LOW/MEDIUM/HIGH/CRITICAL) from change metrics
  • 
    eport-generator.mjs\ — generates the markdown impact report
• *.github/workflows/squad-impact.yml* — runs on PRs targeting dev via \pull_request_target\ (same security model as PR readiness checks)

Security model

• Uses \pull_request_target\ → scripts are checked out from the base branch (trusted), not the PR head
• PR data is fetched read-only via \gh\ CLI
• No untrusted code is executed
• Comment upsert uses <!-- squad-impact-report -->\ marker

Risk tiers

Factor	LOW	MEDIUM	HIGH	CRITICAL
Files changed	≤5	6-20	21-50	>50
Modules touched	≤1	2-4	5-8	>8
Files deleted	—	—	—	>10
Critical files	—	any	—	—

Future (Phase 2)

• 
  outing.md\ ownership mapping
• Reviewer auto-assignment based on module ownership

Closes #733

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit 02bb98f

⚠️ 3 item(s) to address before review

Status	Check	Details
❌	Single commit	2 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	2 active Copilot thread(s) resolved (4 outdated skipped)
❌	CI passing	10 check(s) still running

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[Copilot]

Pull request overview

Adds a new CI workflow and Node-based scripts to generate an automated “architectural impact” report for PRs into dev, including module grouping and a computed risk tier, and posts/updates the report as a PR comment.

Changes:

• Introduces scripts/analyze-impact.mjs plus small utilities to parse changed files, score risk, and generate a markdown report.
• Adds .github/workflows/squad-impact.yml to run the analysis on pull_request_target and upsert a PR comment containing the report.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
scripts/analyze-impact.mjs	Main entrypoint: fetches PR file list via gh, maps files to modules, computes tier, writes impact-report.md, emits JSON summary.
scripts/impact-utils/parse-diff.mjs	Helpers to parse gh pr diff --name-only output and classify files from the PR files API response.
scripts/impact-utils/risk-scorer.mjs	Computes risk tier and explanatory factor strings based on thresholds.
scripts/impact-utils/report-generator.mjs	Builds the markdown report (summary table, factors, per-module breakdown, critical files).
.github/workflows/squad-impact.yml	Runs the analysis on PRs targeting dev (via pull_request_target) and upserts a marker-based PR comment.

[tamirdresher]

LGTM. Clean Phase 1 MVP — module mapping, risk scoring, markdown report. Good foundation for Phase 2 reviewer auto-assignment.

[diberry]

Files in this PR:

• .github/workflows/squad-impact.yml
• scripts/analyze-impact.mjs
• scripts/impact-utils/parse-diff.mjs
• scripts/impact-utils/report-generator.mjs
• scripts/impact-utils/risk-scorer.mjs

[github-actions]

🔒 Security Review

🔒 Security review: 1 info.

Severity	Category	Finding	Location
ℹ️ info	workflow-permissions	Workflow grants write permission — verify this is the minimum required scope.	.github/workflows/squad-impact.yml:14

---

Automated security review — informational only.

[github-actions]

🏗️ Architectural Review

⚠️ Architectural review: 1 info.

Severity	Category	Finding	Files
ℹ️ info	template-sync	Template files changed in .github/workflows/ but not in other template locations. If these templates should stay in sync, consider updating the others too.	Changed: .github/workflows/, Unchanged: templates/, .squad-templates/, packages/squad-cli/templates/

---

Automated architectural review — informational only.