feat(cli): format diffs with an external command via [cli].diff_formatter

[cli].diff_formatter names an optional external argv line (run without a shell)
that formats a diff before the CLI/TUI emits it — both a fenced
```diff/```patch block and a writer tool's diff card. The whole diff goes to the
command's stdin and its stdout is re-emitted with non-SGR control sequences
stripped. On failure, timeout, empty output, or an oversized block the built-in
renderer is used. Like [cli].update_channel it is user/global only: a
project-local reasonix.toml cannot run a command on the user's machine.

The run is memoised per (block content, width), because a View re-renders many
times while a fence streams and again on every resize. It runs only on a closed
fence, so a fence still streaming spawns no subprocess per delta, and the command
is handed the terminal width via COLUMNS with its output clamped to it. A
WaitDelay bounds the wait for a formatter's pipes, so one that leaves a child
holding stdout cannot block the render past the timeout. The writer card drops
the "--- /+++ " pair before piping, so the formatter cannot re-emit a raw host
path the card header already names.

This commit also wires [cli].diff_fences, the opt-in toggle that turns the
fenced-diff renderer on.

docs/CLI.md

@@ -58,6 +58,29 @@ notice. Legacy `[cli].update_channel` values are ignored and removed the next
 time Reasonix saves the configuration. The `reasonix update` alias behaves the
 same way.
 
+`[cli].diff_fences = true` renders a fenced ` ```diff ` / ` ```patch ` block
+through the colourised diff renderer (add/remove backgrounds, `+`/`-` gutter,
+line numbers) instead of the plain code rail. It is **off by default**: a model
+writes headerless diff fences often, and the plain rail is the lossless default.
+A fence section with no `--- `/`+++ ` file header falls back to the plain rail so
+no line is dropped. Like `[cli].diff_formatter` it is user/global only — a
+project-local `reasonix.toml` cannot set it.
+
+`[cli].diff_formatter` names an optional external command that formats a diff
+before the CLI/TUI emits it — a fenced ` ```diff ` / ` ```patch ` block, a writer
+tool's diff card, and a shell result whose whole output is a diff (see
+`[agent].embedded_diff_detection` below).
+
+It is an argv line run without a shell, e.g. `delta --color-only --paging=never`.
+
+The whole diff is written to the command's stdin; its stdout is re-emitted with
+non-SGR control sequences stripped, so the formatter's colours survive but a
+cursor or clipboard escape cannot.
+
+On any failure, timeout, or empty output the built-in renderer is used. Like
+`[cli].update_channel` it is user/global only — a project-local `reasonix.toml`
+cannot set it.
+
 ## Configure providers
 
 ```sh