Add `rb diff` command

[tale]

Add a rb diff subcommand that shows what would change on disk compared to the current state before applying.

For each planned operation:

• WriteFile — diff the planned content against the existing file (or show as new file)
• Symlink — show if the link already exists and points to the correct target, or what would change
• Exec — list commands that would run

This gives users confidence before running rb apply, especially on a new machine or after making config changes. Could share infrastructure with the existing dry-run executor.