fix(performance): cap complexity-regression reads to use corpus reader

[alxxjohn]

Motivation

• The diff-only performance.complexity-regression rule read changed .go paths with os.ReadFile(...) which bypassed the repository's capped reader and could follow attacker-controlled symlinks, enabling scan hangs or unbounded memory use.

Description

• Require env.ReadTargetFile in the early guard so the rule only runs when the safe reader is available by checking env.ReadTargetFile in addition to env.ReadBaseFile and diff mode.
• Replace the direct os.ReadFile(filepath.Join(target.Path, ...)) call with env.ReadTargetFile(target, rel) to reuse the shared, capped file-corpus reader that enforces maxScanFileBytes.
• Reorder logic to call env.ReadBaseFile(target, rel) before reading the head file so newly added files (which have no base) are skipped without reading attacker-controlled worktree targets.
• Preserve the original behavior of returning no finding for deleted, unreadable, oversized, or unparseable files and for files that do not exist in the base revision.

Files changed:

• internal/codeguard/checks/performance/performance_complexity_regression.go

Testing

• Ran gofmt -w internal/codeguard/checks/performance/performance_complexity_regression.go to format the change and git diff --check to validate local diffs; both succeeded.
• Executed unit tests for the rule with go test ./tests/checks -run 'TestComplexityRegression' and observed success.
• Ran broader package tests with go test ./internal/codeguard/checks/performance ./internal/codeguard/runner/support ./tests/checks and observed success.

---

Codex Task