feat(diff): add task diff view components and live-sync hook

[djsdg]

What

Adds the right-side task diff surface for the Ora demo: the React diff view, file tree, collapse state, the live-sync hook that invalidates branch diff queries when the chat store observes completed file-change tool calls, and the minimal Rust contracts (TaskDiffScope, CommitTaskChanges/PushTaskBranch, GetTaskWorkspace*) plus regenerated TypeScript bindings generated by cargo xtask export-contracts.

Scoped to the diff surface only — no workspace-view mount, no i18n strings, no worktree lifecycle hardening. Backend commit/push handlers stay on the codex branch and land in a follow-up PR.

Why

Mirrors the Codex/Claude Code event-driven single-refresh model: agent tool completion → 400ms debounce → queryClient.invalidateQueries({ taskDiffs(taskId) }). No fs.watch, no polling. This keeps the diff view responsive to agent edits without coupling it to Git internals or worktree lifecycle work in flight on other branches.

Changes

Frontend (pure additive)

• packages/app-shell/src/features/diff/ — task-diff-view, task-diff-file-tree, task-diff-collapse + tests + css
• packages/app-shell/src/state/hooks/use-task-diff.ts, use-task-diff-live-sync.ts (+tests), use-task-workspace.ts
• packages/app-shell/src/state/hooks/query-keys.ts — add task diff keys
• packages/app-shell/src/test/mock-client.ts — add task diff client ops
• packages/app-shell/src/global.d.ts — declare side-effect css imports
• packages/app-shell/package.json — add react-diff-view dep

Rust contracts (minimum diff/commit/push surface)

• crates/contracts/src/task_diff.rs — TaskDiffScope, CommitTaskChanges*, PushTaskBranch*
• crates/contracts/src/task.rs — GetTaskWorkspaceRequest/Response, TaskWorkspace
• crates/contracts/src/frontend.rs — register path constants and endpoint metadata
• crates/contracts/src/lib.rs — re-exports
• xtask/src/export_contracts.rs — map new contract types

Generated TS bindings (regenerated)

• packages/contracts/src/{task,task_diff,endpoints,client}.ts

Out of scope (intentionally excluded per "only right-side diff" constraint)

• gitlancer push/snapshot/runner hardening
• application GitTaskGitWriter / TaskGitContext / CommitTaskChangesHandler / PushTaskBranchHandler
• worktree lifecycle migration from WorktreeActivity to WorktreeLifecycle (would break crates/backend others are still optimizing)
• workspace-view.tsx mount of the diff view
• i18n-instance.ts diff strings (no mount → no need)
• POST /api/tasks/{taskId}/git/{commit,push} route wiring (commit/push buttons 404 until follow-up PR)
• ?scope=... query parsing on the backend (currently ignored; frontend tracks scope but server returns branch only)