diff: render a supplied unified diff, and wire codex file changes to it

[tdwd]

codex reports an edit as a ready-made unified hunk and never sends the whole file, so there was no before/after pair to build a fileDiff from.

That looked like a design problem. It was not one: both renderers already worked from unified text. diff.go and diff_split.go each called udiff.Unified(old, new) on their first line and spent the rest of the function parsing the result back to style it. Computing it was only ever step one.

So they now take the unified text and style it, and fileDiff.unifiedText() is the single place that decides whether to use a supplied diff or compute one. No reconstruction, no second renderer, both diff styles working on both backends.

Behaviour-preserving for claude

The same string reaches the same styling loop. The existing renderer tests pass unchanged, which is the check that matters here.

The three codex change kinds

All confirmed against the live CLI, because they put different things in the same diff field:

kind	diff holds	maps to
add	the new file's content	new
delete	the removed file's content	old
update	a unified hunk	unified

Reading that wrong renders a deletion as an addition.

One bug a live test caught

Display paths are trimmed against the working root the agent reported on thread/started, not os.Getwd. Those are equal by convention in production, so the difference is invisible — until a live test rooted in a temp dir rendered the full absolute path across two wrapped lines.

Verified

go vet, full suite, and CATHODE_CODEX_LIVE=1 driving a real edit end to end:

╔════════════════════════════════════════════╗
║  target.txt  +1 -1                         ║
║         │ @@ -1,3 +1,3 @@                  ║
║   1    1│   line one                       ║
║   2     │ - line two                       ║
║        2│ + line TWO                       ║
║   3    3│   line three                     ║
╚════════════════════════════════════════════╝

The new test is discriminating: removing the diff path fails it.

Not verified: the TUI under -backend codex.