feat(rc): publish measured checkout diff summaries - #240

Publish a display/1 diff_summary to the active RC session when a real
checkout diff is established: in `rc start`'s opening batch, and after a
local coding run settles. Paths come from `git status`; counts come only
from git numstat and bounded direct reads, never from prose or model
output. Publication is best-effort: every failure is swallowed and never
changes the local result.

Final behaviour:
- All three counts (files_changed, insertions, deletions) are always
  present, as Cloud's display/1 contract requires. A clean tree is 0/0/0.
- A binary file is a changed file with 0 lines; git has no line count
  for binary ("-" in numstat).
- Untracked text files are counted as git would count them once added,
  with bounded direct reads (8 MiB per file, 32 MiB and 1000 files per
  snapshot) that never follow a link out of the checkout and that honour
  .gitattributes (-diff/binary, diff, filter, working-tree-encoding)
  through `git check-attr`, chunked to fit the Windows command line.
- Any unknown count means no summary rather than a misstated one: a
  failed git read, a changed tracked path numstat did not measure, or an
  untracked file that is too large, external, unreadable or
  filter-converted, or bounds exceeded.
- Unsafe roots and paths are refused: a project root that is not the
  checkout toplevel, and any absolute, traversal, drive-qualified or
  leading-"~" path (Cloud reads a leading "~" as a home path).
- `files` is a prefix of the sorted paths, bounded to 64 entries and to
  16 KiB of JSON as the broker measures it; files_changed counts every
  path.
- The outbox sanitizer refuses a diff_summary without valid
  non-negative integer counts or with an unsafe file path, and sizes
  every payload the way the broker does (ensure_ascii JSON, not UTF-8),
  so no payload Cloud would answer 400 reaches durable storage and
  wedges the batch behind it.

Supersedes #240.
Closes #218.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Publish a display/1 diff_summary to the active RC session when a real
checkout diff is established: in `rc start`'s opening batch, and after a
local coding run settles. Paths come from `git status`; counts come only
from git numstat and bounded direct reads, never from prose or model
output. Publication is best-effort: every failure is swallowed and never
changes the local result.

Final behaviour:
- All three counts (files_changed, insertions, deletions) are always
  present, as Cloud's display/1 contract requires. A clean tree is 0/0/0.
- A binary file is a changed file with 0 lines; git has no line count
  for binary ("-" in numstat).
- Untracked text files are counted as git would count them once added,
  with bounded direct reads (8 MiB per file, 32 MiB and 1000 files per
  snapshot) that never follow a link out of the checkout and that honour
  .gitattributes (-diff/binary, diff, filter, working-tree-encoding)
  through `git check-attr`, chunked to fit the Windows command line.
- Any unknown count means no summary rather than a misstated one: a
  failed git read, a changed tracked path numstat did not measure, or an
  untracked file that is too large, external, unreadable or
  filter-converted, or bounds exceeded.
- Unsafe roots and paths are refused: a project root that is not the
  checkout toplevel, and any absolute, traversal, drive-qualified or
  leading-"~" path (Cloud reads a leading "~" as a home path).
- `files` is a prefix of the sorted paths, bounded to 64 entries and to
  16 KiB of JSON as the broker measures it; files_changed counts every
  path.
- The outbox sanitizer refuses a diff_summary without valid
  non-negative integer counts or with an unsafe file path, and sizes
  every payload the way the broker does (ensure_ascii JSON, not UTF-8),
  so no payload Cloud would answer 400 reaches durable storage and
  wedges the batch behind it.

Supersedes #240.
Closes #218.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>