feat(desktop): surface config diff in restart-required badge

[wpfleger96]

The "Restart required" badge reports that an agent's running config has drifted from its spawn-time config, but never says what changed. This ships the full feature: a typed Rust diff engine and a TS/UI layer that renders it at every badge site.

Rust core (spawn-snapshot diff engine)

Replaces the lossy u64 spawn_config_hash with a typed SpawnConfigSnapshot. The snapshot is stamped from the already-resolved command/env/config values immediately before spawn(), closing the race window where a mid-spawn config edit would suppress the badge.

SpawnConfigSnapshot::canonical() is the single JSON projection shared by the badge and the diff. Drift is to_value(stamped) != to_value(current); the diff is a generic leaf walk over those same two values, so badge-on and diff-non-empty are structurally guaranteed. Adding a snapshot field reaches the UI with no code change to the diff engine — mutation_table_covers_every_serialized_field fails CI if a new field arrives without a mutation row.

eligible_restart_diff(persona_orphaned, Option<TrackedSpawnState>) returns the final vector — snapshot walk entries plus a synthetic adapter_availability entry. It returns empty for an orphaned instance (spawning one would fail) and for agents with no tracked spawn state (never stamped, can never have drifted). needs_restart = !restart_diff.is_empty() derives from that vector and nothing else.

Redaction policy (policy_for(path)) is shared by the wire diff and the snapshot's manual Debug via is_safe_to_reveal() from managed_agents::env_vars as the single authority for env-key masking:

Policy	Paths	Rendering
Text	system_prompt, team_instructions	character counts only
MaskedBare	args, relay_url	••••, no suffix
MaskedSuffix	non-allowlisted env.*	•••• + last 4 chars when longer than 8
Plain	allowlisted env.* (BUZZ_AGENT_THINKING_EFFORT, BUZZ_AGENT_PROVIDER, BUZZ_AGENT_MODEL, DATABRICKS_HOST/MODEL) and everything else	verbatim

Default-deny: every env key not in the explicit allowlist stays masked. is_safe_to_reveal() is the single allowlist authority for both the baked-env display and the diff.

restart_diff is omitted from the wire when empty (skip_serializing_if).

TypeScript / UI layer

New restartDiff.ts module defines RestartDiffEntry, RestartChange, JsonValue; tauri.ts and types.ts re-export and add restart_diff / restartDiff fields (Rust omission → restartDiff: []).

RestartDiffBadge — hover tooltip capped at 6 entries + "and N more", asChild span trigger (never inside a <button>), auto-restart blurb below the diff list (on/off variant from autoRestartEnabled prop; same AUTO_RESTART_ON_BLURB / AUTO_RESTART_OFF_BLURB constants shared with the Runtime-tab banner). RestartDiffList renders the full uncapped list for the Runtime-tab banner with tooltip/inline presentation variants for correct foreground in both surfaces.

ManagedAgentRow B4 fix — badge moved to a sibling div of the row expansion button; tooltip trigger has no button ancestor.

UnifiedAgentsSection — both badge sites render <RestartDiffBadge> instead of a raw <Badge>, with autoRestartEnabled threaded from agent.autoRestartOnConfigChange.

Side-panel fix — RestartDiffBadge rendered tab-independently in the ProfileSummaryView hero area (was Runtime-tab only — root cause of the ~50% inconsistency Will reported). Hero badge is self-center in the flex column. ProfileRuntimeTabContent early-return checks needsRestart so the banner is never dropped when all other content is empty. Auto-restart blurb in the Runtime-tab banner uses the shared constants.

Wire shape

"restart_diff": [
  { "field": "model",              "change": { "kind": "value",  "before": "gpt-5", "after": "claude-4" } },
  { "field": "system_prompt",      "change": { "kind": "text",   "before_chars": 1234, "after_chars": 1410 } },
  { "field": "env.OPENAI_API_KEY", "change": { "kind": "masked", "before": "••••bc12", "after": "••••xyz9" } },
  { "field": "env.BUZZ_AGENT_THINKING_EFFORT", "change": { "kind": "value", "before": "medium", "after": "high" } }
]

added/removed occur only for dynamic-map keys; nullable struct fields always serialize as null; arrays are atomic leaves (args, never args.0).

Tests

Rust — 1902 passing: snapshot mutation coverage, diff entry serialization, allowlist-aware env masking (allowlisted_env_key_shows_plain_value, allowlisted_env_key_is_case_insensitive, non_allowlisted_env_key_stays_masked), unstamped_agent_yields_no_badge_and_no_entries (both orphan values), summary_without_drift_omits_restart_diff_from_the_wire, unstamped_availability_is_not_drift. Clippy clean, fmt clean.

TypeScript — needs-restart-screenshots.spec.ts: 11 E2E cases registered in the smoke project — all three badge sites, tooltip + keyboard focus, DOM no-button-ancestor assertion, 6+1 truncation, uncapped Runtime list, unknown field humanisation, side-panel badge on default Info tab, inactive/friendly-error Runtime opening path.

Consolidates #3652