log: slog through auxilia's scribe, not logrus

This was the last service on the instance still logging through logrus,
and the ecore bump made it a correctness question rather than a
consistency one: the recovery middleware reports a panic through slog's
DEFAULT logger, so without a SetDefault the one record carrying a stack
trace would have gone to Go's plain handler while every other line went
through logrus.

initLogging installs a scribe tint handler on stderr — source on, colour
only when stderr is a terminal, and the mask rules for token, cookie and
authorization. It reads -d out of the argument vector rather than
waiting for core-go's parse, because a daemon that only became verbose
after it had finished starting would be silent for exactly the part of
its life an operator passes -d to watch. Terminal detection is a stdlib
Stat rather than golang.org/x/term, which would be a new dependency for
one predicate.

The startup config check keeps its shape deliberately: it still
accumulates every missing key and reports them in ONE record before ONE
exit, so an operator fixes the config in a single pass. The keys go in
as a slice attribute rather than a joined string, so the structured
sinks keep them as a list.

culpa goes in at the one boundary where it pays: the errors web.New
returns, which are the only errors this package produces and all of
which arrive at that single startup record. Each carries a hint naming
the config key or the build step that fixes it, and scribe.Err unfolds
message, code, hint and stacktrace into fields of their own. The failing
request path logs the same way, with ErrorContext so a cancelled request
reads as cancelled rather than as an unexplained 500.

TestPanicIsAnErrorPage covers the wiring end to end through Register: a
panicking authorizer yields the chrome-wrapped 500, the panic value does
not reach the viewer, and the report reaches slog's default logger.

deps: sr-ht-ecore whose middleware reports panics through slog

The panic report is structured now (method, path, panic, stack) and goes
through slog's default logger, so a service that never calls
slog.SetDefault gets those reports in Go's plain stderr handler. The
next commit is what makes this one land somewhere useful.

deps: sr-ht-ecore with the web-tier packages

Brings in assets, pages, csrf, middleware and ecoretest, plus the
chrome that grew Service.Assets — the slot three services had each
added a field of their own for.

web: draw the chrome from sr-ht-ecore

The nav/service-switcher, the brand, the login block and the environment
banner were a copy of code every custom service on this instance carries.
The copies drifted, so they now come from one place:
sourcecraft.dev/bigbes/sr-ht-ecore/chrome.

web/chrome.go is gone. New builds one chrome.Service from the shared
config.ini and hands it the discovered stylesheet; view() asks it for a
chrome.Page per request, which viewData embeds rather than copies, so a
field ecore adds later arrives here without an edit. The layout invokes
"srht-env-banner" and "srht-nav" instead of the markup it used to spell
out, the landing's repository listing goes through "srht-repo-list", and
the FuncMap starts from chrome.Funcs() with the local shortsha deleted.

Two ecore policies differ from what this service did and are adopted as
the instance's: the brand label is the config section's short name rather
than a literal "compare", and the origins are trimmed of a trailing
slash. What stays local is what is compare's alone: the bundle href, the
diff-status colours, and the container-fluid the two diff views ask for.

Tests move to testify; the nav ordering/exclusion test goes with the code
it tested, and a test that the layout invokes the chrome at all replaces
it.

rename module to sourcecraft.dev/bigbes/sr-ht-compare; depend on sourcecraft sr-ht-core

go.mod: tidy and complete the README

go mod tidy promotes fernet-go and vaughan0/go-ini from indirect to
direct (the cmd entry point imports go-ini and the smoke test imports
fernet) and drops stale transitive checksums for AWS S3/CLI packages that
core-go pulls but compare.sr.ht never imports. The require block is
otherwise unchanged; build and tests stay green.

README: correct the architecture to reflect the go-git in-process backend
(no runtime git shell-out), document the full local development recipe
(config.ini template, key generation, dev-stub, forging a login cookie),
the deployment steps (install, config propagation for nav, DNS,
internal-ipnet, nginx, User=git systemd), and design notes recording the
go-git decision, the 10 MB bundle rationale, and the pending LICENSE.

gitx: repository access and ref-to-ref diffs on go-git

Implement the git access layer for compare.sr.ht on go-git v5 (no runtime
git binary). Public surface: Open (owner/name validated via core, bare-repo
HEAD check, ErrNotFound on any miss); Refs/DefaultBranch; ResolveCommit/Log/
Parents; Diff/RawDiff/DiffStat/MergeBase/CommitPatch.

- Diffs route through DiffTreeWithOptions(DetectRenames) so old/new tree order
  is explicit: three-dot uses the merge base as old side, two-dot uses base;
  CommitPatch diffs a commit against its parent (root vs empty tree, merge vs
  first parent, ParentSHAs exposed for the banner).
- Patch text is generated in memory then capped (5 MiB page, 50 MiB raw,
  injectable override for tests) and cut at a "diff --git" file boundary so the
  browser parser never sees a torn hunk; ctx timeout (10s) guards runaways.
- FileChange status/counts/binary derived purely from go-git FilePatches
  (mapFilePatches); Log excludes base's full reachable set for correct
  base..head semantics.

Tests build fixtures by driving the real git CLI in t.TempDir(). Fidelity gate
(TestPatchFidelity) confirms go-git emits standard git headers — diff --git,
index, rename from/to, "Binary files ... differ", @@ hunks — parseable by the
frontend parsePatchFiles(). 82% coverage.

core validators reject ^/~ so navigation revs are resolved to SHAs in tests.

compare.sr.ht: project foundation — core package, build scaffolding, core-go fork pin

Bootstrap the go.bigb.es/sourcehut-compare service:

- go.mod (go 1.26.4) pinning core-go to the private fork
  git.srht.bigb.es/~bigbes/core-go @ c2c2f3848fa9 via a replace directive;
  go.sum populated by a throwaway smoke build importing core-go
  config/crypto/client/server + chi + logrus (gates API drift from the
  verification baseline fdb3662 to upstream 71b2787).
- core/: pure domain package — sentinel errors, owner/repo/ref validation
  (check-ref-format-style, hostile-input hardened), and the compare-spec
  grammar (ParseCompareSpec, three-dot/two-dot, percent-unescape). Table
  tests at 97% coverage.
- Makefile (all/build/test/css/bundle/run-dev/install), config.example.ini
  documenting the shared keys read in place, contrib/ nginx block and
  systemd unit, README skeleton, .gitignore.

core-go dep deps and go mod tidy are deferred to later phases per plan.