branch: the claims scan diffs against the base ref, not the merge base, and lists upstream's own prose

[lenamonj]

What happened

housebroken branch on a rework head for NVIDIA/k8s-device-plugin #2002 (merge base 4edf2b6, upstream/main at 674f626, seventeen upstream commits ahead, none touching the patch) printed:

CHECK: added prose makes absolute claims - falsify each one against the code:
    2:We only require you to sign your work, the below section describes this!
    129:      where such license applies only to those patent claims licensable
    167:          of the NOTICE file are for informational purposes only and
    ...

None of those lines is in the patch. The patch changes two Go files. The lines are upstream's own edits to CONTRIBUTING.md and LICENSE that landed after the branch point.

Why

scripts/branch-check.sh builds the claims scan from a two-dot diff against the base ref:

claims=$(git diff -U0 "$base..HEAD" -- '*.md' '*.mdx' '*.rst' '*.txt' ...

A two-dot diff between upstream/main and a head that is behind it shows everything upstream added since the branch point as removed and everything the branch lacks as changed. The stat printed a few lines later uses the merge base and is correct:

git diff --stat "$(git merge-base "$base" HEAD)..HEAD"

Rule

Every diff the gate reads is taken against the merge base with the base ref, never against the base ref itself, so the gate only ever reads what the maintainer will see. The claims scan, the comment check and any future scan share one range="$(git merge-base "$base" HEAD)..HEAD".