[codex] Move dotfile drift checks into tools

[mcclayton]

Summary

• Move root diff.sh into tools/diff-dotfiles.sh as a read-only diagnostics tool.
• Extract managed dotfile inventory and config diff helpers into lib/macsetup modules.
• Reuse the shared dotfile list from setup_dot_files.sh and include tools in Docker/checks.

Validation

• bash ./ci/checks.sh
• bash ./ci/docker_start_smoke.sh vim-modern
• git diff --check