feat: Add `affectedTasks` query for task-level change detection (#12215)
## Summary
- Adds an `affectedTasks` GraphQL query that determines which tasks are
affected by changes between two git refs
- Unlike `affectedPackages` which operates at the package level,
`affectedTasks` checks each task's specific `inputs` configuration
against changed files and walks the task dependency graph
- A task is only reported as affected if its inputs actually match a
changed file, or if an upstream task dependency is affected
## Key design decisions
- **Task-level granularity**: Changing a `.md` file won't mark a
`typecheck` task as affected if that task excludes `*.md` from its
inputs, even though the package is technically "affected"
- **Two-phase algorithm**: (1) Match changed files against each task's
input globs for direct affectedness, (2) BFS propagation through the
task dependency graph in O(V + E)
- **Pre-compiled globs**: Glob patterns are compiled once per task
definition and reused across all file checks, avoiding O(files x
patterns) regex compilations
- **Typed change reasons**: The GraphQL response includes a union type
explaining *why* each task is affected (`TaskFileChanged`,
`TaskDependencyTaskChanged`, `TaskPackageDependencyChanged`,
`TaskGlobalFileChanged`, `TaskGlobalDepsChanged`, `TaskAllChanged`)
## Testing
- Integration tests cover: file changes, input exclusions, task
dependency propagation, global dep changes, global file changes, task
name filtering, explicit base/head refs, and no-change scenarios
- Unit tests cover glob matching, glob partitioning, and
file-to-task-input matching including `$TURBO_ROOT$` traversal globs
## Notes for reviewers
- The root `turbo.json` adds `"inputs": ["$TURBO_DEFAULTS$",
"!README.md"]` to the `build` task — this will invalidate remote cache
for all packages' build tasks on the first CI run after merge
- The `wax::Program` import is a trait import providing `is_match()` on
`wax::Glob`, not an unused import