test(sw): detect untracked source files and public API changes

- source-changes.mjs: source guards list untracked, staged, deleted and renamed files, not only git diff --name-only.
- overview / storybook-unused-removal: production source guards use the helper (assertions, paths, approved list unchanged).
- public-api.check.mjs + public-api.approved.json: the built @hm-design/sw entry must export exactly the approved
  names and kinds, keep the package.json export settings and keep every declaration reachable from dist/index.d.ts
  byte-identical. The approved surface was written from a build of 553e4df (approvedMainCommit).

packages/sw/tests/storybook-unused-removal.browser.mjs

@@ -9,6 +9,7 @@ import http from 'node:http'
 import { parse } from '@babel/parser'
 import { swStoryEntries, retiredUnusedDemoIds, integratedChangedFiles, movedToPopupIds, approvedMainCommit, approvedAddedStoryIds, withApprovedEntryChanges, approvedHeaderDeclarations, movedHeaderDeclarations } from './storybook-inventory.mjs'
 import { loadPlaywright } from './playwright-runtime.mjs'
+import { sourceChanges, unapprovedChanges } from './source-changes.mjs'
 
 const out = path.resolve(process.argv[2] ?? 'docs/sw/storybook-unused-story-removal-qa/verify')
 const qa = 'docs/sw/storybook-unused-story-removal-qa/before'
@@ -65,9 +66,9 @@ check('source: retained exports (Stories and ComposedDemo) byte-identical to c8e
 // files (verified by their own suites), may differ from the approved main merge in nothing. sinceBaseline lists the approved
 // changes after c8e5fbe; update approvedMainCommit (storybook-inventory.mjs) on the next approved merge.
 const untouched = ['packages/sw/src', 'packages/sw/ai', 'packages/sw/package.json', 'packages/sw/README.md', 'packages/ui', 'packages/org-chart', 'packages/org-chart-react', 'packages/center-graphic', 'src/sw/sw-header-overview.tsx', 'src/sw/sw-header-dropdown.stories.tsx', 'src/sw/sw-composed-controls.css', 'src/sw/assets', '.storybook']
-const changedSince = ref => execFileSync('git', ['diff', '--name-only', ref, '--', ...untouched], { encoding: 'utf8' }).trim().split(/\r?\n/).filter(Boolean)
-const unexpected = changedSince(approvedMainCommit).filter(file => !integratedChangedFiles.includes(file))
-check('source: other packages, Overview, Dropdown CSF, assets and Storybook config unchanged since the approved main merge; SW package only within the integrated-improvement files', unexpected.length === 0, { unexpected, sinceBaseline: changedSince(baseCommit).length })
+// Untracked new files count as changes (source-changes.mjs).
+const unexpected = unapprovedChanges(approvedMainCommit, untouched, integratedChangedFiles)
+check('source: other packages, Overview, Dropdown CSF, assets and Storybook config unchanged since the approved main merge; SW package only within the integrated-improvement files', unexpected.length === 0, { unexpected, sinceBaseline: sourceChanges(baseCommit, untouched).length })
 
 // ---- Browser
 const root = path.resolve('storybook-static'), mime = { '.html': 'text/html', '.js': 'text/javascript', '.css': 'text/css', '.json': 'application/json', '.svg': 'image/svg+xml', '.png': 'image/png', '.gif': 'image/gif', '.ttf': 'font/ttf', '.woff2': 'font/woff2' }