chore(hooks): dedup TESTS_CHANGED against category test globs (#3929)

* chore(hooks): dedup TESTS_CHANGED against category test globs

Greptile-apps review on PR #3928 caught that a changed resilience-* /
handlers / seed test file is captured in BOTH the category run
(RUN_RESILIENCE / RUN_SERVER / RUN_SEED globs) AND the TESTS_CHANGED
unconditional block, so the same test executes twice on every push.

Subtract category-covered tests from TESTS_CHANGED right after capture:

- `tests/resilience-*` removed when RUN_RESILIENCE fires (the
  resilience-* glob already runs them)
- `tests/handlers.test.*` / `tests/server-handlers.test.*` removed when
  RUN_SERVER fires
- Any test file matching the SEED_TESTS derivation
  (scripts/seed-X.mjs → tests/X-seed.test.mjs) removed when RUN_SEED's
  list is non-empty (uses `grep -vxF -f <(...)` for full-line literal
  match against the seed list)

SEED_TESTS computation is hoisted out of the RUN_SEED block to the same
scope as TESTS_CHANGED so the subtraction doesn't re-derive it. The
RUN_SEED block consumes the same variable.

Smoke-tested:
- {resilience-foo, other}.test.mjs + RUN_RESILIENCE=true → only
  other.test.mjs in TESTS_CHANGED after subtraction
- {handlers, server-handlers, foo}.test.* + RUN_SERVER=true → only
  foo.test.* in TESTS_CHANGED after subtraction

* chore(hooks): tighten RUN_SERVER dedup to literal file list

The previous regex `^tests/(handlers|server-handlers)\.test\.(mjs|mts)$`
stripped four name/extension combinations from TESTS_CHANGED while the
category run only executes the asymmetric pair `tests/handlers.test.mts`
+ `tests/server-handlers.test.mjs`. If anyone ever added
`tests/handlers.test.mjs` or `tests/server-handlers.test.mts`, the
dedup would drop it from TESTS_CHANGED but the category command would
not run it — silent test-skip.

Hoist SERVER_TESTS to the same scope as SEED_TESTS (single source of
truth), have RUN_SERVER consume it, and use the same `grep -vxF -f`
literal full-line match the SEED_TESTS dedup already uses. Now "what
RUN_SERVER runs" and "what's subtracted from TESTS_CHANGED" cannot
drift.

* fix(hooks): gate TESTS_CHANGED dedup on RUN_ALL != true

When RUN_ALL=true (e.g. package.json / tsconfig changed, or
changed-files couldn't be resolved from origin/main), the
RUN_RESILIENCE / RUN_SERVER / RUN_SEED category runners are skipped —
the `if [ "$RUN_ALL" != true ]` block below the dedup gates them. But
the dedup block ran unconditionally, stripping category-covered tests
from TESTS_CHANGED even though no category runner was going to execute
them.

Net effect: on any push that triggered RUN_ALL alongside a category flag
(e.g. package.json + server/foo.ts + tests/handlers.test.mts), the
changed test silently didn't run pre-push at all. CI catches it on PR
open, but the whole point of TESTS_CHANGED is to surface test-file
regressions before the push.

Fix: gate the dedup on `RUN_ALL != true`. When no categories run, no
dedup is needed and TESTS_CHANGED ships full to the unconditional
runner.

Smoke-tested all four RUN_ALL × RUN_SERVER combinations.