Serve the captured task diff for the card drawer's diff viewer.

The diff bytes were captured beside the run journal at completion time (task_diff_captured), so they are exactly what executed and are available against a detached run - no live git at review time. The served bytes are re-hashed and cross-checked against the journal-chained capture hash: verified is true only when the diff a reviewer folds open equals the diff that was captured and the chain still recomputes.