Dry-run diff engine (apply-ladder rung one, zero writes)

[eventually-consistent-code]

Diff live bucket config (get-bucket-lifecycle/tiering) against generated artifacts: what WOULD change, rule-by-rule, plus manifest freshness checks. --dry-run-diff; read-only guaranteed; output shaped for a future guarded apply. REQ-06 (m5).