Fix code copy button covering code annotation marker - #15136

Pull request runs check out the merge commit, so comparing absolute counts with the baseline blamed every open PR for an increase merged on main by another PR (#15136 after #15134). With --against HEAD^1 the PR is compared with the base branch tip and judged only on its own change; push runs keep the absolute baseline gate.

gitChanges reads NUL-delimited git output through execProcess, splits renames into delete + add and checks every git call. --accept-increase replaces --accept-tests-increase and accepts any scope, since an uncovered increase in src needs a bump too.

The new tests are characterisation tests of new functions: their first run failed at module load, which is not a RED step.

Pull request runs now compare against the base branch, so a PR is judged
on its own change. Comparing absolute counts blamed every open PR for an
increase merged to main by another PR (#15136 after #15134). The check
nets increases out per Deno API and per std module before any file is
blamed, so a renamed file or a moved call is not a finding.

An increase is an error only for a Deno API that src/deno_ral covers
equivalently (build.os and build.arch, in scopes that can import it).
Every other increase is a warning on the added line, and the job
summary gives the per-scope delta and the baseline bump a maintainer
accepts with --accept-increase. Std imports get only a suggested
replacement, since a name check cannot show that a wrapper exports what
the file uses. Pushes to main and manual runs keep the absolute baseline
gate.

- Delta mode reads the baseline committed at the base revision. A PR
  that adds nothing while main is above baseline gets only a notice.
- Delta mode lists the whole base tree rather than passing every changed
  path to git, which keeps long comparisons under the Windows
  command-line limit.
- Counts use a prototype-free dictionary, so an identifier such as
  constructor is an ordinary key.
- src/core/lib is browser-shared and cannot import src/deno_ral, so an
  increase there is a warning, not an error.

Related to #15134, #15135 and #15136.

A code block that starts or ends a callout had its copy button above
the code frame, with more space than a paragraph at the same edge.
Since #13024 wrapped code blocks in a scaffold element, the callout edge
rules applied to the scaffold instead of the code. At a callout edge the
scaffold now takes its spacing as margin, so the button sits inside the
code frame and the code gets the same gap as a paragraph.

- Use margin instead of padding for code at a callout edge, including
 cells whose edge child is code
- Exclude the copy button from the callout last-child spacing rule
- Hit-test annotated code block markers in callouts (#13444), which
 needs #15136 merged first
- Titled callouts now leave a gap between the header and the code
 frame, unlike the flush layout in 1.7

See #13238 for the broader padding-to-margin change, which this does
not include, and #15137 for the same offset in column-grid sections.

Fixes #13446