feat(cloud): add Docker workspace diff view

[mohakchakraborty2004]

Summary

• Add Docker-only Cloud workspace changed-file summaries and per-file unified diffs.
• Surface changed file count and additions/deletions in the Cloud Files UI.
• Keep NodeOps and Coder unsupported; add structured, content-safe request logs.

Verification

• npm --prefix frontend test -- --run src/renderer/i18n/renderer-coverage.test.ts
• npm --prefix frontend test -- --run src/renderer/components/SessionInspector.test.tsx -t 'hides Reviews when the session has no PR'
• npm --prefix frontend run typecheck
• cloud Go tests and Docker local smoke were completed on the original implementation branch.

Follow-up

• Docker-only by design; NodeOps and Coder are intentionally excluded.

[mohakchakraborty2004]

Breakdown of this pr changes :

Core Docker diff implementation (~290 lines)
Cloud UI (~230 lines)

API contract/client plumbing (~240 lines) :
OpenAPI contract update
generated Cloud client schema/types
renderer-facing Cloud control-plane client method and types
This is required because the frontend cannot call the Docker worker directly.

Tests and Docker smoke validation (~390 lines)

Preview of how it will look like. Only updated for docker vms. To be reviewed and then updated for the clouds : nodeOps and coder

[i-trytoohard]

@mohakchakraborty2004 friendly nudge: if there's an issue this addresses, please link it (Fixes #N). If none exists, no action needed.

[Pritom14]

Reviewed against the local file-diff feature. Parity and content-safe logging look good. A few things to fix before this can merge or deploy.

Blocking: migration number collision

• 00037_workspace_diff_file_requests.sql reuses 00037, which is already taken by 00037_turns_allow_queued_fanin.sql (applied on the staging CP).
• On the current DB, goose sees version 37 as applied and skips this migration. The workspace.diff-file kind never gets added, so those worker requests fail the CHECK constraint at runtime.
• On merge to main it is a hard goose duplicate-version conflict.
• Fix: renumber to 00038.

Scope: Docker-only will not work on coder

• The handler returns unsupported for NodeOps and Coder. Staging and the pilot run on coder, so the diff panel is inert there.
• Please confirm that is acceptable, or track coder support as a follow-up.

Telemetry: missing

• No PostHog events for the diff feature, unlike the existing pattern (cloud_workers_viewed, cloud_worker_opened).
• Add cloud_workspace_diff_viewed on panel open, and optionally cloud_diff_file_opened on expand. This is not redundant with the server logs, which are for ops rather than product usage.

Observability: good but slightly redundant

• Logging is thorough and content-safe (paths and metadata, no file bytes). Nice.
• The CP handler and the transport supervisor both log started and completed at INFO for the same request, so up to 4 INFO lines per file.
• Suggest keeping completed and failed at the handler at INFO (it has the org/session/provider context), and moving the supervisor duplicates and the started lines to DEBUG.

Correct, no change needed

• Migration is additive. workspace.diff already existed (00008/00011/00032), so the Down correctly removes only workspace.diff-file. Only the number is wrong.
• The frontend reuses the local diff stack (@pierre/diffs CodeView, shared pierre theme, WorkspaceDiffView). Good parity, not a reimplementation.

Priority order: renumber the migration, decide on the coder scope, add the diff telemetry, dedupe the INFO logging.