Share One Recursive-Tree Change-Set Reader Between pr_review.py and audit.py #2789

Problem

Two hub tools now read a change set past the REST compare's 300-file cap the same way, each with its own copy of the reader. Both read a recursive tree for the merge base and for the other side, keep blob and submodule entries, diff them by path and object id, and refuse a truncated tree.

• scripts/pr_review.py: tree_at and tree_changed_at, added for Carry a File Table Past the Compare Endpoint's 300-File Ceiling #2767, which carry_holds reads where both compares reach the cap.
• spec/audit.py: repo_tree_entries, and the inline merge-base, develop and main tree reads in the branch-drift check that feed classify_branch_drift.

A fix to one copy, such as how a truncated tree or a submodule entry is read, does not reach the other.

Expected

One recursive-tree reader and one tree diff that both tools use, or a recorded reason they stay separate (for example that scripts/pr_review.py must stay a single self-contained file). Found by the local strict-review pass on the change for #2767, which left spec/audit.py alone because it is a file that change does not touch.