Use `git diff` instead of plain `diff`

[drevell]

We've had a couple of issues now where the differences in git behavior between platforms causes problems. diff behaves differently on macos 12 vs macos 14 when coloring diff output, for example. By using git diff instead, we get more uniform behavior and fewer bugs.

This comes at a cost, though. The git diff command is missing some important flags that exist on regular diff, like:

• missing -N flag to treat nonexistent files as empty
• missing --label flag to override the filenames that are part of the diff output
• inability to dereference symlinks

The absence of these flags forces us into a huge hack: to diff two files and output a diff where the files seem to be named p1 and p2, we have to create a temp directory and copy the two files into that temp dir as a/p1 and b/p2. This incurs filesystem overhead and is hacky as heck.

So given this is super hacky, why are we still doing it?

• The temp dir is likely to be on tmpfs in RAM, so the FS operations should be fast. The non-tmpfs filesystem operations don't change (there's still one read of of the files to be diffed).
• The complexity cost is worth having a uniform diff API across systems.

A similar problem exists for the patch command. If this PR is approved, I'll replace patch with git patch next. patch also has inconsistencies across macos versions.