fix(deps): bump diff to ^9.0.0 to clear GHSA-73rr-hh4g-fpgx (#1588)

[genisis0x]

Closes #1588.

Summary

npm audit flags diff@7.0.0 with a low-severity DoS in parsePatch/applyPatch (GHSA-73rr-hh4g-fpgx, affected 6.0.0–8.0.2, fixed in 9.0.0). gstack uses diff against local content the user controls so practical risk is low, but the advisory shows on every audit pass and blocks clean supply-chain runs for users who vendor gstack.

Compatibility check

diff@9's breaking changes only touch parsePatch / applyPatch / createPatch and the ESM/CJS exports. Call sites in this repo:

• browse/src/snapshot.ts:568 — Diff.diffLines(lastSnapshot, snapshotText)
• browse/src/meta-commands.ts:712 — Diff.diffLines(text1, text2)

diffLines signature + return shape are unchanged in v9, so no runtime impact. Smoke-tested locally:

import * as Diff from 'diff';
Diff.diffLines('a\nb\nc\n', 'a\nB\nc\n');
// [{value:'a\n'}, {removed:true,value:'b\n'}, {added:true,value:'B\n'}, {value:'c\n'}]

Test plan

• bun install — clean resolve, single package updated
• bun test — same pre-existing sidebar-ux.test.ts failures as main (unrelated; tests grep server.ts for symbols already removed); no new failures introduced
• Manual Diff.diffLines round-trip against v9 confirmed identical output

Happy to bundle this into the next fix wave or land standalone, whichever's lighter on your end.