refactor(util): make render_diff generic (caller supplies side titles); move to root util

Generalize render_diff so it isn't supervise-flavored: the "(current)" /
"(proposed)" side titles are no longer baked in — callers pass `before_title`
and `after_label` (required). Move it from orchestrator/supervisor/util.py to
the base bot_bottle.util alongside sha256_hex, and delete the now-empty
supervisor/util.py.

The supervise callsite (Orchestrator.supervise_respond) assigns
before_title="current", after_label="proposed"; the facade no longer re-exports
render_diff (callers import from bot_bottle.util). Behavior at the supervise
callsite is unchanged.

Full unit suite green (2243).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/orchestrator/service.py

@@ -40,8 +40,8 @@ from .supervisor import (
     TOOL_EGRESS_ALLOW,
     TOOL_EGRESS_BLOCK,
     Supervisor,
-    render_diff,
 )
+from ..util import render_diff
 
 
 # Operator decision → Response.status. The apply half (egress tools) runs
@@ -350,7 +350,10 @@ class Orchestrator:
                 operator_action=status,
                 operator_notes=notes,
                 justification=proposal.justification,
-                diff=render_diff(diff_before, diff_after, label=component),
+                diff=render_diff(
+                    diff_before, diff_after, label=component,
+                    before_title="current", after_label="proposed",
+                ),
             ))
         return True, ""