Add read-only prepared catalog semantic diff

[schickling-assistant]

Why

Transactional catalog consumers can prove the live declaration root, but they cannot currently inspect what a fully admitted prepared catalog would change without applying it. That forces downstream policy to infer semantics from bytes or duplicate Agent Spec parsing.

What

• add st2 catalog diff --prepared DIR --expect-sha256 HEX --json
• hold the existing shared authoring lock and capture prepared input through retained no-follow capabilities
• fully admit both live and prepared projections before emitting a receipt
• report versioned, deterministically ordered projected-path and normalized Agent Spec-model field deltas
• keep payload values, per-field hashes, migration policy, and publication authority out of the receipt
• document the durable requirement and exact receipt contract

The command is read-only: it does not initialize a catalog or write declarations, markers, generation state, runtime state, workspaces, or the prepared source.

Verification

• cargo test --test catalog_diff: 14 passed
• cargo clippy --test catalog_diff -- --cap-lints warn: passed; only pre-existing library warnings remain
• independent implementation and VRS reviews: approved
• cargo test --workspace --all-targets: remainder passed with the documented host-isolation skip after excluding four failures reproduced on the pristine base; one transient PTY registry test passed on isolated retry

The remaining effect-level path normalization and watcher consumption gap stays explicit in the Agent Spec VRS and is outside this policy-free primitive.

[schickling-assistant]

Thanks @myobie for the careful guidance on the PTY boundary and for making the upstream primitives strong enough to keep this comparison policy-free. Merged cleanly!