feat(cli): make Registry diffs human-readable - #8

Closes #7

User problem

The first real Registry startup Collector works, but the default Diff output leads with opaque internal identity instead of showing a recognizable startup value, its decoded data, and where it was observed.

What changed

• make the default systemdiff diff output a calm, factual Registry startup summary;
• add systemdiff diff --technical for Collector version/scope, canonical identity, native Registry evidence, hashes, decode status, before/after values, coverage, and diagnostics;
• preserve the existing deterministic --json Diff v1 document unchanged;
• escape control and bidirectional formatting characters from untrusted evidence in terminal output;
• refresh the English and Chinese README first screen with a truthful Registry-only demo, current/planned capability boundaries, privacy warnings, and real CTAs;
• add a verified transcript and a static terminal SVG derived from that exact synthetic output;
• extend the dual-gated real Windows E2E to verify both text renderers without expanding its guarded HKCU write scope.

Before / after UX

Before, the terminal primarily displayed an ArtifactKey and opaque canonical hash. The default output now names the Registry value, reports Added/Modified/Removed/Inconclusive factually, shows decoded command/value data when available, and displays the readable Registry location. Technical and JSON evidence remain explicit modes.

Validation

• cargo fmt --all --check
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo test --locked --workspace --all-targets — 88 passed
• Registry-only human, technical, and JSON CLI smoke tests
• existing broad-fixture CI smoke commands and collectors
• dual-gated real Windows HKCU E2E — exactly 1 Added, 0 Removed; human/technical evidence matched; exact-data cleanup and temporary Snapshot deletion verified
• Markdown links, English/Chinese factual parity, stale-claim scan, secret/local-path scan, SVG XML/render inspection, and git diff --check
• independent reviewer: High 0 / Medium 0 / actionable Low 0 after fixes

Explicit non-goals

No Services or Scheduled Tasks Collector, session/baseline/history workflow, release pipeline, schema change, rules/risk scoring, Authenticode, redaction implementation, GUI/Tauri, installer, updater, or package-manager work is included.