ci: diff changed stacks against CI_PREV_COMMIT_SHA, not HEAD~1

HEAD~1 on a merge commit is the feature-branch parent, so the
changed-stack detection diffed the WRONG side and silently skipped the
stacks the push actually changed — pipeline 128 'succeeded' without
applying the new ci-pipeline-health stack. Use the push's true
before-state (CI_PREV_COMMIT_SHA) when it resolves, HEAD~1 as fallback
(first build / shallow edge cases). Also touches the ci-pipeline-health
stack so THIS push applies it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

stacks/ci-pipeline-health/main.tf

@@ -9,6 +9,8 @@
 #
 # Runs IN-CLUSTER (not a claude.ai cloud routine) because Vault and the
 # Woodpecker token are LAN-only — cloud agents can't reach them.
+#
+# First apply rode the DIFF_BASE fix (pipeline-128 merge-commit detection bug).
 
 variable "schedule" {
   type = string