feat: add yaml-diff reusable workflow

[weatherhog]

Summary

Adds a new reusable workflow yaml-diff.yaml that posts a semantic YAML diff (via dyff) of source files changed in a PR as a sticky PR comment. Key reordering without value changes is ignored, so reviewers see only meaningful changes.

Companion to helm-render-diff.yaml (which diffs rendered Helm output, not source).

Together these enable consumers — starting with giantswarm/gitops-template — to drop alphabetical-key-ordering enforcement from their yamllint configs without losing diff readability. See giantswarm/roadmap#4121.

Design notes

• Same pattern as helm-render-diff.yaml: check-cmp-state opt-out job + find-comment → delete → create-or-update trio.
• Shared opt-out /no_diffs_printing: one command silences both bots.
• Size caps: per-file 5k chars, total 60k chars — prevents silent failure at GitHub's 65536-char comment limit, with link to the run on truncation.
• Default excludes: **/*.enc.yaml (SOPS), .github/**, .pre-commit-config.yaml — mirrors the ignore: block in gitops-template/.yamllint.
• Concurrency: cancels in-progress runs on the same PR to avoid pile-up on rapid pushes.
• Permissions: least-privilege — pull-requests: read on the opt-out check job, contents: read + pull-requests: write only on the diff job.
• All third-party actions pinned to commit SHA per repo CLAUDE.md.

Inputs

Input	Default	Description
dyff_version	1.7.1	dyff release to install
paths	*.yaml *.yml	git pathspecs selecting files to diff
exclude_paths	**/*.enc.yaml .github/** .pre-commit-config.yaml	glob patterns to exclude

Test plan

• Adopted in giantswarm/gitops-template via companion PR (separate)
• PR with key-reorder-only YAML change → bot posts "No semantic YAML differences"
• PR with semantic value change → bot posts only the value diff
• /no_diffs_printing in PR body or comment → bot skips
• PR touching a *.enc.yaml → excluded
• Large diff (>60k chars) → truncation + link to workflow run
• Repeat push → comment updates in place (find/delete/create), no spam; concurrent pushes cancel earlier runs

Follow-up

Once this workflow has been running in gitops-template for ~1–2 weeks on real PRs, a separate small PR will drop key-ordering: {} from gitops-template/.yamllint, closing #4121.

🤖 Generated with Claude Code