Add reusable workflow diff

[platinummonkey]

What does this PR do?

Adds shared JSON resource diff plumbing and exposes pup workflows diff <workflow-id> <file> with the same --only/--ignore filtering used by monitor diff. It also keeps workflow diff tests aligned with the SDK's required action_id response shape and fetches workflow diff state as raw JSON to avoid SDK deserialization/defaulting noise.

Motivation

Issue #634 requests diff support beyond monitors, with workflows as the concrete example. This starts that rollout by extracting reusable diff output and normalization behavior, then applying it to Workflow Automation.

Changes

• Added ResourceDiffOptions, nested read-only path stripping, optional diff roots, and shared diff formatting in src/util_ext.rs.
• Refactored monitor diff to use the shared helper while preserving its partial-update guidance.
• Added workflow diff command implementation and clap dispatch in src/commands/workflows.rs and src/main.rs.
• Normalized workflow action_id as read-only and included it in the workflow diff mock response so the SDK can deserialize representative workflow JSON where typed paths still apply.
• Fetch live workflow JSON for diff through the raw client, so diff compares the API payload directly without SDK deserialization requirements or defaults.
• Documented workflow diff in docs/COMMANDS.md and docs/EXAMPLES.md.

Testing

• cargo +stable fmt --check
• git diff --check
• Datadog CI logs for Check, Test & Coverage and Cross Compile (Windows) showed one failing test: commands::workflows::tests::test_workflows_diff_detects_changes, caused by missing action_id in the workflow mock response; the follow-up CI run showed the same SDK deserialization dependency, so workflow diff now fetches raw JSON.
• Attempted cargo +stable test test_workflows_diff_detects_changes, but Cargo could not fetch the pinned datadog-api-client-rust git dependency from GitHub in this sandbox (403 / allowlist block).

Additional Notes

Follow-up PRs can add dashboard, SLO, notebook, pipeline, and other resource diff commands on top of the shared helper.

Checklist

• The code change follows the project conventions (see CONTRIBUTING.md)
• Tests have been added/updated (if applicable)
• Documentation has been updated (if applicable)
• All CI checks pass
• Code coverage is maintained or improved

Related Issues

Closes #634

---

PR by Bits - View session in Datadog

Comment @DataDog to request changes

[datadog-datadog-prod-us1]

View session in Datadog

Bits Code status: ✅ Done

CI Auto-fix: Passed | Disable

Comment @DataDog to request changes

[datadog-datadog-prod-us1-2]

I can only run on private repositories.