workspace-diff endpoint shows empty diff for committed changes — should show branch-vs-base for push preview

[HappyLiang12]

Bug Description

The GET /api/v1/runs/{runId}/workspace-diff endpoint runs \git diff\ (unstaged) and \git diff --cached\ (staged). After a successful commit, both return empty because there are no uncommitted changes. For the push/PR approval gate DiffPreview, it should show what's being pushed (branch-vs-base diff).

Reproduction

1. Worker clones repo, creates branch, writes file, commits
2. git_push triggers approval gate
3. GET /api/v1/runs/{runId}/workspace-diff → hasWorkspace=true, diff='', summary=''
4. DiffPreview shows '(no uncommitted changes)' — useless for reviewing what will be pushed

Expected Behavior

For push/PR gates, the diff should show \git diff main..HEAD\ or \git log --oneline main..HEAD\ to display what the branch adds relative to the base.

Impact

• DiffPreview at push/PR gates shows nothing useful
• Operators cannot review code changes before approving
• Defeats the purpose of the code-diff preview feature

Suggested Fix

In WorkspaceDiffController, when the workspace is a git repo with commits ahead of the base branch, show \git diff {base}..HEAD\ instead of just uncommitted changes.

Environment

• Branch: main @ d65f916, h2 profile