verify: verification prepare reads an in-repo --diff-from from the base; a directory replaced by a file is not a config_error #1076

Deferred by the engineering-review implementation loop from #1074 (issue #1024).

Problem

Two smaller gaps beside #1024's fix:

1. verification prepare --base X --diff-from <in-repo path> (src/agents_shipgate/cli/verification.py:156) still reads the checkout copy of the reference, while verify now reads it from the base ref (fix(verify): read in-repo --diff-from and ci policy from the base #1074). The portable plan can therefore be built from a PR-controlled reference.
2. A PR that replaces a directory with a same-named file makes verify exit 2 with config_error: _bind_changed_files (src/agents_shipgate/cli/verify/orchestrator.py, around line 2594 on main) treats only FileNotFoundError as "absent", so NotADirectoryError (ENOTDIR) escapes. Reproduced locally by the fix(verify): read in-repo --diff-from and ci policy from the base #1074 implementer.

Proposed fix

(1) Route verification prepare's in-repo --diff-from through the same base-ref read verify uses after #1074, with a test. (2) Treat NotADirectoryError like FileNotFoundError in _bind_changed_files (and any sibling that walks changed paths), with a test that swaps a directory for a file.

Acceptance criteria

• verification prepare with an in-repo reference reads it from the base ref and records that in the plan.
• A directory-to-file replacement is bound as a changed path, not a config_error.

Source

Engineering review 2026-10-12 follow-up (PR #1074 implementer notes). Tracked in #1060.