feat: add line-level creed diff preview (COD-384)

[shivros]

Summary

Implements creed diff [--target <target>] as a generated service operation. It renders the same candidate files as sync and reports deterministic, line-level unified diffs for changed, created, and safely tracked stale/deleted outputs.

• Adds generated CLI, MCP, and HTTP operation surfaces from internal/service.Service
• Adds LCS-based unified diff output with valid empty-side ranges and EOF-newline markers
• Preserves sync --dry-run behavior
• Uses .creed/.outputs/<target>.json only to discover stale Creed-owned outputs; arbitrary user files are never adopted
• Includes candidate paths in inventory even when pre-existing projects lack ownership metadata
• Rejects symlinked ownership-metadata directories so metadata cannot be written outside the project

Verification

go generate ./...
go build ./...
go test -race -count=1 ./...
go vet ./...
gofmt -l .                 # no output
scripts/check-generated.sh # generated code is current
git diff --check origin/main...HEAD

All passed locally.

Review panel

Both reviewers identified correctness/security issues before handoff:

1. Candidate skill outputs were incorrectly shown as newly created if no ownership manifest existed. Fixed by passing rendered candidates into inventory.
2. A symlinked .creed/.outputs directory could redirect ownership metadata outside the project. Fixed by validating ownership-directory components and adding regression coverage.

The PR is intentionally draft for human review; it must not be auto-merged.

Closes COD-384.

[shivros]

🤖 Automated Review Panel

GPT-5.5 (openai/gpt-5.5)

Finding (fixed before PR): diff omitted rendered directory-style candidate paths when no ownership manifest existed, falsely reporting matching legacy output as newly created. Inventory now receives all rendered candidates while ownership metadata remains limited to stale-output discovery. Added a regression test.

The reviewer otherwise confirmed the direct Go gates and CLI behavior passed.

---

Gemini 3 Flash (google/gemini-3-flash-preview)

Finding (fixed before PR): a symlinked .creed/.outputs directory could redirect ownership metadata outside the project during sync. Ownership metadata directory components are now validated as non-symlink directories before read/write, with regression coverage.

The reviewer approved unified-diff coordinate/newline behavior, CLI exit semantics, dry-run preservation, and safe non-adoption of arbitrary user output after this correction.