fix(deps): bump diff to ^9.0.0 to clear GHSA-73rr-hh4g-fpgx (#1588)

`npm audit` flags diff@7.0.0 with a low-severity DoS in
parsePatch/applyPatch (GHSA-73rr-hh4g-fpgx, affected 6.0.0–8.0.2,
fixed in 9.0.0). gstack uses diff against local content the user
controls so practical risk is low, but the advisory surfaces on every
audit pass and blocks clean supply-chain runs for users vendoring
gstack.

The 9.0.0 breaking changes only touch parsePatch / applyPatch /
createPatch and the ESM/CJS exports. Both call sites in this repo
(browse/src/snapshot.ts:568, browse/src/meta-commands.ts:712) use
`Diff.diffLines`, whose signature and return shape are unchanged in
v9, so this is a no-op at runtime.

Author: genisis0x

bun.lock

@@ -45,7 +45,7 @@
   "dependencies": {
     "@huggingface/transformers": "^4.1.0",
     "@ngrok/ngrok": "^1.7.0",
-    "diff": "^7.0.0",
+    "diff": "^9.0.0",
     "marked": "^18.0.2",
     "playwright": "^1.58.2",
     "puppeteer-core": "^24.40.0",