Add `dotagent diff <agent>` — human-readable manifest drift

dotagent already detects manifest drift — `dotagent doctor` warns when the SHA256 of `agent.toml` on disk differs from the one cached during the last daemon run. The warning gives you the SHA prefixes but not the actual diff. To see what changed, you have to compare against `git log` or your own backup.

## Proposal

A new subcommand:

```
dotagent diff # disk vs daemon cache
dotagent diff --since 7d # disk vs the version current 7 days ago
```

Output: a human-readable unified diff of the parsed manifest fields (not the raw TOML text), so reorderings or comment-only changes are filtered out.

```
hello-fish

agent.timeout_seconds: 60 → 120
+ new schedule: nightly (cron weekday=mon-sun 02:00)
- removed: notifiers[0] driver=slack
```

## Acceptance criteria

- [ ] Diffs the parsed `AgentManifest` struct, not raw bytes.
- [ ] Shows field-level changes in the form `key: old → new`.
- [ ] Added/removed array entries are clearly distinguished from in-place updates.
- [ ] `--since ` walks back through the manifest cache history (if multiple versions are retained) or returns a clear error if not available.
- [ ] Exit code is 0 when no drift, 1 when drift exists (scriptable).

## Where to start

- `crates/dotagent-state/src/manifest_cache.rs` — the cache that already stores SHA and timestamp.
- `crates/dotagent-core/src/manifest.rs` — the `AgentManifest` struct to diff over.
- `dotagent doctor`'s drift detection has the comparison logic to extract.

## Non-goals

- Persisting full historical manifests by default. v1 only compares disk vs the most recent cache snapshot. Multi-version history is follow-up.
- A 3-way merge tool. Just a diff.

Start with crates/dotagent-state/src/manifest_cache.rs and crates/dotagent-core/src/manifest.rs, then inspect dotagent doctor's existing drift comparison. Define the v1 scope around the latest cache snapshot and the parsed AgentManifest fields. Done means the diff command reports field and array changes, handles no drift and unavailable history with the specified exit codes and errors.

Written by the indexing model from the issue text.