Add --only-new flag to report only new findings (with --changed-from/--changed) #24

Problem

--changed-from <ref> / --changed <file> already classify each cluster as new / known / unscoped, and --fail-on-duplicates fails on new only. But the report still prints every cluster (all known ones too). In a CI gate the handful of actionable new clusters are buried under the pre-existing backlog.

Real case (abholer dry-ts-duplicates CI job): run emitted 6 new + 73 known clusters. The job correctly failed on the 6, but to find them you scroll past 73 known clusters. A clean refactor's signal is drowned in noise.

Proposed change

Add a flag (suggest --only-new) that, when combined with --changed-from/--changed, restricts output to clusters with status new. Exit-code behavior stays governed by --fail-on-duplicates — this is purely an output filter, not a detection change.

Behavior / acceptance criteria

• --only-new filters reported clusters to status == new; known/unscoped are omitted.
• Requires --changed-from or --changed (without a change scope there is no new status) — error out with a clear message if used alone.
• Honored across all --format values: text, json, edn (the json/edn arrays contain only the new clusters).
• Exit code unchanged: still 0/1 per --fail-on-duplicates over new clusters, regardless of what is printed.
• Summary line should still convey totals, e.g. showing 6 new (73 known hidden), so suppression is visible.

Why separate from #19–#23

#19–#23 reduce false positives in detection/scoring. This is orthogonal: it scopes reporting output for the incremental/CI workflow. Pairs well with --fail-on-duplicates for gate logs.