feat: changed_only config key to start on the changed-only tree

[smarzban]

Closes #195

What

New config key changed_only = true|false (default false). When true the viewer starts as if c had already been pressed: the changed-only tree against the active baseline. c still toggles back to the full tree.

• Config.changed_only → EffectiveSettings.changed_only (config > default, no env var).
• Controller::apply_changed_only reuses the c toggle, so it is a no-op outside a git repo (full tree, no notice), clears nothing it shouldn't, and re-renders for the filtered selection. Wired in app::run before the launch open target, next to expand_changed.
• After startup the flag behaves exactly like a pressed c: refresh / b re-filter, d replaces it, a worktree switch carries the current c state (it does not re-read the key).

Docs

docs/configuration.md (precedence list, example block, prose), docs/usage.md (git-awareness), config.example.toml, ? Settings row, CHANGELOG.md, and both key lists in tests/docs_consistency.rs.

Tests

• config.rs: changed_only_resolves_config_over_default.
• tests/controller.rs: starts on the changed-only tree (only the changed file visible, cursor off the clean file, render dispatched, survives a refresh, idempotent); c toggles back; false leaves the full tree with no re-render; non-git root ignores it.
• help.rs Settings row lists.

cargo fmt --check, cargo clippy --all-targets -- -D warnings, cargo test, cargo audit all green locally (macOS).

Real-binary proof

Release build, throwaway repo on branch feat with src/util.rs modified and docs/new.md untracked, HERDR_PLUGIN_CONFIG_DIR pointing at a changed_only = true config. First frame:

┌repo────────────────────────┐
│● ▾ docs                    │
│?     new.md                │
│● ▾ src                     │
│M     util.rs               │

c → full tree (docs, src, Cargo.toml, README.md); c again → back to changed-only. Same repo without the key starts on the full tree. A non-git dir with the key on shows the full tree.