Stacked on #20892.

Why

#20892 adds the TUI workspace command abstraction so branch status metadata can run through app-server instead of assuming the CLI process has the active workspace locally. /diff still used direct local process execution, which means remote app-server sessions could compute the diff against the wrong machine or fail to see the active workspace at all.

This PR moves /diff onto that same app-server-backed command path so Git runs wherever the active workspace lives.

What Changed

• Route /diff through the TUI WorkspaceCommandExecutor using the active chat cwd.
• Replace direct tokio::process::Command usage in get_git_diff with argv-based workspace command requests.
• Preserve the existing /diff behavior: tracked diff output, untracked file diffs, treating Git diff exit code 1 as success, and showing the existing non-git-repository message.
• Extend WorkspaceCommand with caller-set timeouts and an explicit uncapped-output opt-out. Metadata probes remain capped by default; /diff opts out because its full output is the user-visible payload.

How to Test

Manual reviewer path:

1. Start the Codex TUI from a Git worktree with one tracked file change and one untracked file.
2. Run /diff.
3. Confirm the rendered diff includes both the tracked diff and the untracked file diff.
4. Start the TUI outside a Git worktree, or switch to a non-git cwd, then run /diff.
5. Confirm it shows the existing /diff not-inside-a-git-repository message.

Targeted tests run:

• cargo test -p codex-tui get_git_diff -- --nocapture
• cargo test -p codex-tui branch_summary -- --nocapture
• cargo test -p codex-tui