ci: report this build's coverage and benchmarks

The pipeline built and published an apk and said nothing about the code it
packaged. It now runs the suite as `make cover COVERPROFILE=$HOME/cover.out`
and POSTs the profile to cov.srht.bigb.es under ~bigbes/sr-ht-compare — the
name on the sources: line, not the renamed service's.

`cover` is not a second suite: it is `test` with two flags reached through
TESTFLAGS, so CI's command and a developer's `make test` cannot become two
different runs. -covermode=atomic because this is a concurrent server and the
default set mode records that a statement ran rather than how often.

There was nothing to upload to bench.sr.ht either, gitx having no benchmark at
all. The diffing path — what a request here is actually spent in — now has
five: Diff in both of the grammars a compare URL can carry, DiffStat,
CommitPatch, and the two pure functions under them, mapFilePatches and
cutPatch. They build their own fixture, 40 files of 120 lines with a branch
that diverged, because the test fixture's dozen lines measure opening a
repository rather than diffing one.

`make -s bench` writes benchfmt to $HOME/bench.txt and three greps refuse to
upload a file the expected names are missing from: `go test -bench` that
matches nothing prints ok and exits 0, and an empty file is valid benchfmt.
Both uploads turn tracing off around the token, use --fail-with-body so a
refusal is printed and still fatal, and strip both ref prefixes because this
pipeline builds tags too.

cover.out and bench.txt are declared as artifacts, so a failed upload leaves
the report recoverable, and gitignored, because written into the checkout they
would stamp the packaged binary +dirty.

The manifest is now within 560 bytes of the 16 KiB a submission may carry; the
reasoning lives in docs/ci.md, which says so.

rename the service to diff.sr.ht

The instance-facing name changes and nothing else does: the config.ini section,
the origin, the apk package, the nginx block and the systemd unit are all
diff.sr.ht now, and the brand's red service label reads "diff" because chrome
derives it from the section name.

What deliberately stays is everything whose rename would cost more than it is
worth: the Go module path, the repository name, the comparesrht binary, and the
/~owner/repo/compare/base...head routes people have in their history. README
says so at the top so the split is not read as an oversight.

ci: the family's build pipeline, and PKGVER by export

Brings this manifest to the shape the sibling services share.

cacher is installed by install.sh instead of a raw curl of the binary, in
two tasks: install.sh appends its PATH export to ~/.buildenv, which only
the next task sources. The old fetch had no -f, so an HTTP error body was
written to ~/.local/bin/cacher and chmod +x'd; the installer verifies
against checksums.txt.

The version task drops the sed of the tracked APKBUILD. Measured on
go1.26.5, rewriting a tracked file sets vcs.modified=true and Go stamps
+dirty into Main.Version for the whole abuild run, so PKGVER is exported
and APKBUILD reads pkgver="${PKGVER:-0.0.0}". One git describe decides
it: the tag, the tag plus commits, or the commit count. Tags join
allow-refs so pushing v0.9.0 produces the 0.9.0 apk. The export alone is
not enough — abuild works inside the checkout and puts src/, pkg/ and
GOTMPDIR=tmp/ there, so .gitignore covers all three.

cache_restore takes --optional rather than || true, which also swallowed
bad credentials and a dead bucket, and gains the half-restored module
cache repair block. cache_save moves after publish so an S3 hiccup cannot
strand a good apk, and loses its cacher exists guards: dir upload already
skips a present key. publish gains the no-credentials gate.

The stylesheet is now built in CI: sassc and minify, the scss task that
materializes the shared partials no apk ships, make css before the
compile and make check-css after it. The committed
web/static/main.min.79713f25.css stays tracked for now — build() prints
git status and the digest so the first CI run says whether the pipeline
reproduces those bytes, and dropping it from the index is a second step.

package() calls make install-files. abuild runs it in a fresh process
that never called build(), so make install would relink the binary from a
cold cache and ship a compilation nothing had checked.

Reasoning lives in docs/ci.md: the manifest is a varchar(16384) and a
branch over the cap gets no CI at all

web: content-hash the bundle and colour the status column

Two diff-view fixes reported against the deployed instance.

Empty file tree after an upgrade: bundle.js had a stable filename served with a
1-hour cache, so browsers kept a pre-fix bundle and the @pierre/trees sidebar
rendered blank. Content-hash the bundle like the stylesheet — Makefile emits
bundle.<sha256[:8]>.js, server.go globs it into a BundleHref, the templates
reference {{.BundleHref}}, and the hashed name is served immutable. A deploy now
always busts the cache.

Unreadable status column: the changed-files table rendered A/M/D in the dim
default cell colour, near-invisible on the dark chrome. Render each status as a
semantic .diff-status badge (added=green, modified=amber, deleted=red,
renamed=blue) with light/dark variants, via statusClass/statusLabel helpers and
a small self-contained style block (the sourcehut-derived main.min.css can't be
rebuilt locally).

Tests resolve the hashed bundle via a bundleName helper and assert its immutable
cache header; docs updated for the hashed filename.

cmd/comparesrht: daemon entry point, startup validation, dev stub

Wire the compare.sr.ht daemon on core-go's server.New: it runs
crypto.InitCrypto, parses -b/-d/-m/-p, and drives the standard SourceHut
warm-shutdown loop (SIGINT). We deliberately skip WithDefaultMiddleware
(it demands Postgres/Redis and 401s anonymous viewers) and instead
install the web package's documented middleware chain — RealIP, Recoverer,
Logger, config.Middleware, authz.Middleware — inside a Group on the
anonymous router.

validateConfig checks every required key up front (network-key, webhook
key, repos root, a git.sr.ht API origin candidate, meta and compare
origins) with a single clear fatal, so a misconfiguration fails loudly at
startup rather than as a deep panic in config.GetAPI on the first request.

A build-and-exec smoke test proves the binary starts against a synthesized
config, answers /healthz 200, and exits cleanly on SIGINT in under 15s.

Makefile: build ./comparesrht from ./cmd/comparesrht, run-dev binds
localhost:5090 against a local config.ini, install ships the binary and
static assets. contrib/dev-stub is a stdlib-only fake git.sr.ht GraphQL
API returning fixed public repos for local development, and the systemd
unit now stops with KillSignal=SIGINT to hit the warm-shutdown path.

frontend: pierre diffs/trees bundle and sourcehut theme css

Vendored esbuild bundle (frontend/src/app.ts) rendering @pierre/diffs
FileDiff per file and a @pierre/trees FileTree sidebar against the SSR
#compare-data contract, plus scss/main.scss (base + compare views)
compiled and content-hashed into web/static/.

compare.sr.ht: project foundation — core package, build scaffolding, core-go fork pin

Bootstrap the go.bigb.es/sourcehut-compare service:

- go.mod (go 1.26.4) pinning core-go to the private fork
  git.srht.bigb.es/~bigbes/core-go @ c2c2f3848fa9 via a replace directive;
  go.sum populated by a throwaway smoke build importing core-go
  config/crypto/client/server + chi + logrus (gates API drift from the
  verification baseline fdb3662 to upstream 71b2787).
- core/: pure domain package — sentinel errors, owner/repo/ref validation
  (check-ref-format-style, hostile-input hardened), and the compare-spec
  grammar (ParseCompareSpec, three-dot/two-dot, percent-unescape). Table
  tests at 97% coverage.
- Makefile (all/build/test/css/bundle/run-dev/install), config.example.ini
  documenting the shared keys read in place, contrib/ nginx block and
  systemd unit, README skeleton, .gitignore.

core-go dep deps and go mod tidy are deferred to later phases per plan.