test(sw): detect untracked source files and public API changes

- source-changes.mjs: source guards list untracked, staged, deleted and renamed files, not only git diff --name-only.
- overview / storybook-unused-removal: production source guards use the helper (assertions, paths, approved list unchanged).
- public-api.check.mjs + public-api.approved.json: the built @hm-design/sw entry must export exactly the approved
  names and kinds, keep the package.json export settings and keep every declaration reachable from dist/index.d.ts
  byte-identical. The approved surface was written from a build of 553e4df (approvedMainCommit).

packages/sw/tests/overview.browser.mjs

@@ -7,6 +7,7 @@ import http from 'node:http'
 import { parse } from '@babel/parser'
 import { swStoryEntries, retainedInventory, inventorySignature, retiredDropdownIds, integratedChangedFiles, integratedStoryIds, retiredPropertyPanelIds, retiredUnusedDemoIds, movedHomeMenuIds, retiredHomeMenuCompareIds, movedToPopupIds, approvedMainCommit, homeMenuSidebarIds, withApprovedEntryChanges, approvedHeaderDeclarations, movedHeaderDeclarations } from './storybook-inventory.mjs'
 import { loadPlaywright } from './playwright-runtime.mjs'
+import { sourceChanges, unapprovedChanges } from './source-changes.mjs'
 
 const out = path.resolve(process.argv[2] ?? 'docs/sw/storybook-overview-qa')
 await mkdir(out, { recursive: true })
@@ -46,8 +47,8 @@ check('retained non-Overview declarations byte-identical to 50bf5bd or their app
 check('retired Dropdown IDs absent', retiredDropdownIds.every(id => !after.some(e => e.id === id)))
 // The package source may differ from the approved main merge only in the integrated-improvement files (their own suites
 // verify them). Approved package changes after 50bf5bd are listed as sinceBaseline; update approvedMainCommit on the next approved merge.
-const sourceFiles = (...refs) => execFileSync('git', ['diff', '--name-only', ...refs, '--', 'packages/sw/src'], { encoding:'utf8' }).trim().split(/\r?\n/).filter(Boolean)
-const sourceDiff = { unapproved: sourceFiles(report.approvedMainCommit).filter(file => !integratedChangedFiles.includes(file)), sinceBaseline: sourceFiles(report.baseCommit).length }
+// Untracked new source files count as changes (source-changes.mjs).
+const sourceDiff = { unapproved: unapprovedChanges(report.approvedMainCommit, ['packages/sw/src'], integratedChangedFiles), sinceBaseline: sourceChanges(report.baseCommit, ['packages/sw/src']).length }
 check('package production source unchanged since the approved main merge except the integrated-improvement files', sourceDiff.unapproved.length === 0, sourceDiff)
 
 const root = path.resolve('storybook-static'), mime = { '.html':'text/html','.js':'text/javascript','.css':'text/css','.json':'application/json','.svg':'image/svg+xml','.ttf':'font/ttf','.png':'image/png' }