feat(diff): add dash0 diff command

[mmanciop]

Summary

• New experimental dash0 diff -f <file|directory> [--since <ref>] command previews what apply would do (creates, updates, and — with --since — deletions), without ever mutating anything.
• Fetches each document's current state from Dash0 first (per-kind, non-mutating) to accurately distinguish create from update — unlike apply --dry-run, which is local-only and cannot tell the two apart.
• All-or-nothing fetch gate: any document fetch failure (other than a plain "not found") aborts the whole plan before anything is printed.
• --since <ref> reuses apply --since's identifier-diffing to preview deletions alongside creates/updates, never deleting anything.
• Three-way exit code (0 clean, 1 differences pending, 2 error), modeled on kubectl diff — a deliberate, narrow exception to this CLI's uniform 0/1 convention.
• Human-mode unified-diff report and agent-mode JSON output matching apply --dry-run's {path, changes} shape, extended with a "create" op.
• apply --dry-run is now deprecated in favor of dash0 diff, with a runtime stderr warning and updated help text.

Semantic comparison engine

The comparison behind diff (and apply/dashboards update's diff rendering, since they share internal/asset.PrintDiff) is semantic, not textual. It's backed by a new shared engine in dash0hq/dash0-api-client-go#32 — ported from terraform-provider-dash0's existing internal/converter (used across all 8 of its resource types today), rather than reimplementing the same logic separately.

This closes real gaps a naive text diff has: key/slice reordering, duration-string formatting ("2m" vs "2m0s"), int-vs-float representation differences between YAML and JSON, API-populated defaults absent from the local document, and (for check rules specifically) the default annotation values the Dash0 JSON → Prometheus YAML conversion omits by default. None of these are reported as changes anymore, and the printed diff itself is now built from normalized YAML so it isn't cluttered by them either.

Note: this PR currently depends on dash0-api-client-go#32, which is open but not yet merged/released — developed against this repo's existing local replace directive in go.mod (an established pattern here for in-flight client-library changes). The replace directive will be removed and go.mod bumped to a real released version before this is ready to merge.

Supporting changes

• Moved apply --since's git-diffing plan (deletionPlan) into internal/git as the exported SincePlan/ComputeSincePlan, so diff can reuse it without depending on internal/apply.
• Moved apply's document validation (validateDocuments) and PrometheusRule CRD parsing into internal/asset as ValidateDocuments/ParsePrometheusRuleCRD, for the same reason.
• Found and fixed a real cobra Traverse bug in cmd/dash0/main.go: a boolean persistent flag preceding the subcommand (e.g. dash0 --experimental diff ..., the form used throughout this CLI's own docs) was misresolved to the root command, because Traverse's flag lookup doesn't see PersistentFlags() until cobra's own lazy merge runs during Execute. This silently broke diff's exit code (always falling back to 1 instead of 2 on a genuine error) for that invocation order. Fixed by merging persistent flags into the root command's own flag set before the pre-flight Traverse call; regression test included (TestTraverseTargetCommand/TestTraverseTargetCommand_ReproducesBugWithoutFix).

Why this is stacked

This PR targets refactor/shared-document-model (#255), which extracted the shared document model both apply and diff need.

Test plan

• go build ./...
• go vet ./...
• go test ./...
• go test -tags=integration ./...
• make lint
• make skill-validate
• make chlog-validate
• Manual smoke test: dash0 --experimental diff -f <fixture> for create/update/clean/error cases, exit codes 0/1/2 confirmed with both -X-before and -X-after subcommand ordering.
• New tests covering the semantic engine's real-world behavior on dash0-cli's actual asset types: reordered slices, duration-format equivalence, check-rule default annotation values, the bare sharing annotation key check rules use, custom check-rule labels, and notification channels' spec.routing.assets.