data_diff: PII redaction / opt-in for sample diff rows

Flagged during v0.5.22 release review (Security / Chaos Gremlin persona).

Up to 5 sample differing rows — including their raw values — appear in `data_diff` tool output (`packages/opencode/src/altimate/tools/data-diff.ts` ~L220) and up to 100 in aggregated partitioned diffs (`native/connections/data-diff.ts` `mergeOutcomes`). For tables containing PII (email, SSN, credit_card) this:

- Flows into LLM context (shipped to model providers, including Altimate backend)
- Appears in session transcripts / Recap traces on disk
- Is not redacted or gated

**Short-term mitigation (shipped in 0.5.22):** tool description + permission prompt warns users; recommends `algorithm='profile'` for PII-bearing tables.

**Proper fix (this issue):**
1. Add `include_sample_rows: boolean` param (default false OR default true with a config flag)
2. If false, strip `diff_rows[].values` before returning, keep counts
3. Optional: integrate with `schema.detect_pii` (if available) to gate automatically
4. Document in the data-parity skill

Deferred because: requires a product policy decision on the default (ship safe vs ship useful) and a compat path for existing skill users.