fix(analyzer): add rate limiting, working-tree reset, and partial persistence (#4)

Three real failures surfaced in the first end-to-end run against
v3.17.0 -> v3.17.4 (116 commits). Addressing all three:

1. Rate limiting on pass 1
   Copilot Student / Pro tier caps low-tier models at 15 req/min. The
   first run blew through the limit at request #15 and returned instant
   429 fallbacks ("NEEDS_REVIEW" with no reasoning) for commits 16-116.
   Add a RateLimiter (requests-per-minute, simple interval throttle) and
   wire it through classifyCommitsSequentially. Default 12 rpm stays
   comfortably under the ceiling.

2. Dirty working tree blocked batch-builder checkout
   `bun install` without --frozen-lockfile modifies bun.lock, then
   createBranchFromTag calls `git checkout -b` which refuses to proceed
   with:
     error: Your local changes to the following files would be overwritten
            by checkout: bun.lock
   Add resetWorkingTree() (git reset --hard HEAD + git clean -fdx except
   .analyzer-output) and call it before batch-building. Safe because the
   CI clone is ephemeral and never pushed.

3. Crashes lost all partial progress
   When pass 1 or later steps failed, the workflow uploaded nothing
   useful since artifacts were only written at the end. Rewrite
   runPipeline to writeArtifact after each pass:
     classifications.initial.json (after pass 1)
     verifications.json + classifications.json (after pass 2)
     synthesis.json (after pass 3)
     batches.json (after batch-builder)
     pipeline-result.json (combined, at the end)
   Combined with `if: always()` on the upload step, this guarantees
   post-mortem data even on crash.

classifyCommitsSequentially signature changed from positional to an
options object to make the new requestsPerMinute parameter optional
without threading boilerplate through callers.