Pipeline: determine test targets from git diff, not namespace

Currently Omni.Pipeline.Verify uses the task's namespace (a single Haskell module path) to decide what to build and test via bild <namespace> and bild --test <namespace>. This is fragile: a change might touch multiple files, the namespace might not be set, or it might not reflect what actually changed.

Instead, the verify step should: 1. Use git diff --name-only <base>..<task-branch> to get the list of changed files 2. Derive build/test targets from those changed files (each changed .hs file is a potential bild target) 3. Run bild and bild --test on each affected target 4. Aggregate results (fail if any target fails)

This applies to both verifyTask and verifyOnBase. The namespace field on tasks can remain as metadata but should not be the sole driver of what gets verified.

Key files:

• Omni/Pipeline/Verify.hs — main verify logic, needs the git-diff-based target resolution
• Omni/Pipeline/Git.hs — already has git helpers, may need a changedFiles function
• Omni/Pipeline/Core.hs — VerifyResult type definitions

The function signature for verifyTask currently takes Maybe Text (namespace). It should instead compute targets from the git diff between baseBranch and taskId. If no files changed (or none are buildable), skip verification gracefully.