PY-PORT: git_patch_id.py -> aprender-ci-tools git-patch-id (child of #4741) #4800

Child of #4741 (C301: no Python in the build).

Port scripts/lib/git_patch_id.py (a byte-exact git patch-id --stable|--verbatim|--unstable for gits older than 2.40) into crates/aprender-ci-tools as the git-patch-id subcommand.

Done when:

• the subcommand prints byte-identical output to the .py over a shared case table (whitespace, CRLF, binary hunks, \ No newline, several patches with commit/From oids, an empty input, and a bad mode, which both sides refuse);
• it equals the golden ids already pinned in scripts/lib/pr_review_patch_id.sh self-test, and the native git patch-id where that git has the mode;
• callers keep the .py for now (gate tools use already-released features); switching callers is a later child.