Add workspace diff summary and validation tools for AI workflows

[chubes4]

Problem

AI workflows can currently edit, status, commit, push, and open PRs, but there is no first-class workspace tool that summarizes or validates the diff before PR creation.

The PHP transformer iterator needs this because bad PRs are worse than fallback issues. One earlier smoke opened a junk PR in the wrong repo with an unused bootstrap helper:

• Bad generated PR: Handle simple hero section fallback chubes4/static-site-importer#188

Prompt rules helped, but this should be enforced by runtime/tool contracts where possible.

Proposed shape

Add read-only tools such as:

• workspace_diff_summary
• workspace_diff_validate

Example validation config:

{
  "repo": "html-to-blocks-converter@fix/plain-hero-section-group",
  "require_changed_files": {
    "include_any": [
      "includes/class-transform-registry.php",
      "tests/"
    ],
    "deny": [
      "static-site-importer.php"
    ]
  },
  "require_tests": true
}

Requirements

• Summarize changed files, added/deleted lines, and whether tests were touched.
• Optionally validate allowed/denied path patterns.
• Optionally require at least one test file change.
• Return machine-readable pass/fail details.
• Keep it read-only and safe for local and remote workspace backends where possible.

Why this matters

This lets Data Machine workflows gate PR creation on actual diff shape instead of only prompt instructions.

Related context

• wc-site-generator PR feat(workspace): report worktree disk cleanup pressure #149 added prompt guardrails after the bad SSI PR.
• wc-site-generator PR feat(workspace): add hygiene report #150 improves discovery with workspace_grep, but diff-shape validation is still missing.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Drafting this issue from iterator PR quality failures and desired runtime validation shape.