Get Subdomains Delta

Diff the domain's subdomain inventory against a past point in time.

Classifies every observed subdomain relative to since:

• added — first observed after since (new in the inventory).
• removed — was in the inventory at since but no certificate naming it has been observed since then. "Removed" strictly means the name rolled out of CertIndex's observation window — CT logs only record issuance, so this is NOT evidence the host was decommissioned or its certificate revoked. A host with a long-lived cert and no re-issuance will drift into this class while still being live.
• unchanged — present at since and re-observed since then.

Each class list is truncated at limit (largest cert_count first); the *_count fields always carry full class totals. For very large apexes the underlying scan is bounded (results_partial=true).