[quality] check-local-overrides ignores NO_COLOR for diff's own output (diff --color="always" is unconditional)

[hivecommons-hive]

Finding

check-local-overrides in
system_files/shared/usr/share/ublue-os/just/default.just branches on
NO_COLOR for the palette it applies itself:

if [ "${NO_COLOR}" == 1 ]; then
    BLUE_COLOR=""
    GREEN_COLOR=""
    YELLOW_COLOR=""

…but the diff invocation two lines later hardcodes:

diff -qr \
  --suppress-common-lines \
  --color="always" \

So with NO_COLOR=1 the recipe's own blue/green/yellow highlighting is
correctly dropped, yet diff still writes raw ANSI escapes. The result is
partially-colored output that no NO_COLOR consumer asked for, and escape
bytes leaking into logs, pipes, and ujust check-local-overrides > file.

Reproduced while writing BATS coverage for this recipe (PR #1048). Under
NO_COLOR=1 the output for a file present only in /etc is still:

^[[0m^[[0m: custom.conf^[[0m

RESET="\x1b[0m" is also assigned unconditionally, so it is emitted by the
final sed rule even in the NO_COLOR=1 branch — same class of bug.

Recommendation

1. Make the diff color mode follow NO_COLOR, e.g. select
   --color="never" when NO_COLOR=1 and --color="always" otherwise
   (or use --color="auto" and let diff decide from the tty).
2. Clear RESET alongside the other palette variables in the NO_COLOR=1
   branch so the trailing sed rules emit no escapes at all.
3. PR test(default.just): BATS coverage for bios, bios-info, enroll-secure-boot-key, toggle-user-motd, check-local-overrides, check-idle-power-draw, benchmark #1048 already pins the current behaviour with a test named
   check-local-overrides: diff --color=always is unconditional (NO_COLOR gap).
   Whoever fixes this should flip that test to assert the escape-free output;
   it is written to make the fix visible rather than to bless the bug.

This is a production-code change in default.just, so the quality agent is
filing it rather than patching it.

Priority

• Impact: low
• Effort: low

---

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: 56961d4

— hive: agent=quality backend=copilot model=claude-opus-5