feat: cascade plan shows the workflow diff before writing

[joshua-temple]

Running generation overwrites the managed workflow files in place. There is no way to
preview exactly what would change before committing to it, which makes upgrades and
manifest edits feel risky.

Add a read-only cascade plan subcommand that renders the workflows from the current
manifest and prints a unified diff against the committed files, writing nothing.

Proposed approach:

• New plan subcommand sharing the generation path with generate-workflow.
• Print a unified diff per managed file; write nothing to disk.
• Pair naturally with verify (item 4): plan is the human-facing preview, verify is
  the pass/fail gate.

Acceptance criteria:

• plan writes nothing and prints a per-file unified diff of pending changes.
• With no pending changes it reports a clean tree.
• An e2e scenario edits the manifest and asserts the diff reflects the change.