fix(deps): bump diff 7.0.0 → 9.0.0 (GHSA-73rr-hh4g-fpgx parsePatch DoS)

The advisory affects diff 6.x–8.0.2. The only API this repo uses is
Diff.diffLines (browse/src/snapshot.ts:571, browse/src/meta-commands.ts:728),
which is unchanged across the major hop; snapshot tests pass against 9.0.0.

Closes #1588.

Contributed by @genisis0x (PR #1599; VERSION collateral stripped, lockfile
regenerated fresh).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

package.json

@@ -53,7 +53,7 @@
   "dependencies": {
     "@huggingface/transformers": "^4.1.0",
     "@ngrok/ngrok": "^1.7.0",
-    "diff": "^7.0.0",
+    "diff": "^9.0.0",
     "html-to-docx": "1.8.0",
     "marked": "^18.0.2",
     "playwright": "^1.58.2",