[ty] Add Git-aware diagnostic diff mode

[Gankra]

Summary

(Disclaimer: I had codex spit this out on a whim, I haven't looked at it, although the PR description reflects the desired behaviour/motivation of the PR.)

Adds ty check --diff [REVISION], which reports only diagnostics introduced by the current branch or working-tree changes, analogous to git-clang-format:

# compares to default branch
ty check --diff

# compares to given branch or commit
ty check --diff base-branch

The point of this feature is twofold:

• It enables a codebase to incrementally adopt stricter rules with minimal disruption to existing PRs / without thrashing the history, the original motivation of git-clang-format.
• It enables a codebase to adopt future hypothetical lints that depend on mutable outside information (like new vulnerabilities in dependencies) without setting off alarm bells on every single PR, while still setting off an alarm when a PR legitimately introduces a new usage of a vulnerable API.

Existing diagnostics are matched by file, mapped source location, rule, severity, and message, so inserting lines above an existing error or renaming its file ideally does not incorrectly report it as new.

Rather than filtering diagnostics to modified lines, we check the project at the Git merge base, update the same Salsa database to the current working tree, and compare the resulting diagnostics. This lets us catch errors introduced in unchanged files, such as existing call sites affected by a changed function signature. This is ostensibly performant because it can lean on ty lsp machinery for handling diffs.

[astral-sh-bot]

Typing conformance results

No changes detected ✅

Current numbers

The percentage of diagnostics emitted that were expected errors held steady at 96.96%. The percentage of expected errors that received a diagnostic held steady at 92.96%. The number of fully passing files held steady at 106/133.

[Gankra]

Notable caveat: this approach necessarily doesn't induce venv updates if your branch changed a dependency. Fixing that would require more leveraging of uv integration (we could pass uv --isolated and potentially tell it to reuse the isolated venv it hands us on the second run).