Add workflow to deploy hl7-diff dist artifact into source/diff/

[Copilot]

Automates what was previously a manual copy of the dist/ output from brianpos/hl7-diff into source/diff/ of this repo (as done in commit 226d494). Implemented as Option A (this repo pulls the artifact) with no third-party action dependencies, and parameterized so the caller picks which branch receives the update.

Changes

• New workflow .github/workflows/update-diff.yml
  • Trigger: workflow_dispatch only — the Run workflow dropdown selects the target branch, and the commit is pushed back to that same branch (HEAD:${{ github.ref_name }}), so main or any feature branch works.
  • Optional source_run_id input — blank uses the latest successful Build run on hl7-diff@main; a specific id pins to that build.
  • Resolves the run id, downloads the dist artifact, wipes source/diff/ to avoid stale Vite-hashed filenames, copies the new contents in, commits, and pushes. No-op exit when there's no diff.

Dependencies

• actions/checkout@v4 and the preinstalled gh CLI (authenticated with the default GITHUB_TOKEN).
• No third-party actions, no PATs, no cross-repo secrets — hl7-diff is public, so artifact download works with the default token; contents: write permission covers the push.

Example

# From the API, target the main branch with the latest hl7-diff build:
gh workflow run update-diff.yml --repo brianpos/web-source --ref main

# Or stage into a feature branch and pin to a specific hl7-diff run:
gh workflow run update-diff.yml --repo brianpos/web-source \
  --ref preview-diff-update \
  -f source_run_id=25033683921

Notes for review

• source/diff/ is fully replaced on each run; if anything outside the artifact is intentionally kept there, the wipe step needs scoping.
• Commit author is github-actions[bot]; switch to a different identity if branch-protection rules require a real user.