schema.diff: compare the model with an environment's live schema, or two environments

[jcombs-pointblue]

Summary

For DirXMLDevWeb#77 (Jerry: "schema is per environment. we need to be able to compare between each env and the git model").

• SchemaDiff.of(left, right): definitions matched by NDS name, else LDAP name, case-insensitively; a change is a definition only one side has, or one both have with another syntax, OID, flag, superclass, containment, naming or attribute list (lists as sets, case-insensitive). A field neither side states (Designer's copy carries no OIDs) is not a difference. A custom definition the tree has not pushed is marked.
• SchemaDiff.modelVsLive(tree, env) and liveVsLive(a, b); live(env) reads cn=schema the way vault.schema does. Nothing written.
• CLI: schema.diff <tree> --env E [--json] and schema.diff --env A --other B [--json] (routed with the vault.* commands); exit 0 when in sync. docs/schema.md "Comparing".

Verification

• SchemaDiffTest: only-left (custom marked), only-right, a flag and an optional-list difference, case-insensitive names, a missing OID on one side ignored, identical schemas in sync.
• Live on edir3 from the e2e tree: after vault.schema, schema.diff reports in sync over 2330 attributes and 293 classes; after schema.add-attribute, one difference < attribute PB Diff Probe (custom, not pushed); removed again.
• bin/ci-portable.sh passes.

🤖 Generated with Claude Code

[jcombs-pointblue]

Merged into master by hand (merge commit) and released in 0.17.0; GitHub shows the PR closed because the branch was deleted after the merge.