dashboard: diff against applied/proposal/<id>, prefer fetched_sha

approval_diff now runs git diff refs/heads/main..refs/tags/
proposal/<id> against the applied repo instead of cobbling a
single-file diff from proposed. consequences: multi-file
proposals show every change, manager amendments in proposed
cannot lie about what'll be deployed, no-op proposals render
an explicit '(proposal matches currently-deployed tree)'.
displayed sha prefers fetched_sha (hive-c0re-vouched) and
falls back to commit_ref only for the brief pre-fetch window.
unified_diff helper + similar dep dropped — git diff is the
source of truth now. dead-code allows on the lifecycle git
helpers + approvals.set_fetched_sha come off since all are
wired up. readme picks up the tag flow + /applied RO mount.

hive-c0re/src/approvals.rs

@@ -93,7 +93,6 @@ impl Approvals {
 
     /// Record the canonical sha hive-c0re fetched from the proposed repo
     /// into applied at submission time. Idempotent on identical values.
-    #[allow(dead_code)] // wired up by manager_server in the next commit
     pub fn set_fetched_sha(&self, id: i64, sha: &str) -> Result<()> {
         let conn = self.conn.lock().unwrap();
         conn.execute(