[v0.5] Implement Security Profile Diff for pull requests

[niansia]

Produce a focused security decision delta between a base and head profile instead of returning the entire control catalog for every pull request.

Initial output contract:

• Pack and capability state transitions.
• Newly required or deactivated controls.
• New composition intersections.
• New deterministic findings and required verification.
• Separate source change from detector/catalog version change.
• Bind both inputs to their subject revisions and decision-model digests.
• Add positive, negative, stale-input, and schema regressions.