Add gen-sdk vs legacy SDK comparison tooling (shadow-gen diff)

[pose]

Context

Part of the gen-sdk migration epic, pulumi/home#4787. Before flipping a provider+language to gen-sdk we must prove its output matches the legacy codegen output.

Scope

A reusable comparison ("shadow-gen diff") script in provider-ci, a make compare_sdk_<lang> target, and a CI job.

Acceptance criteria

• For a provider+language, generates the SDK both ways from the same schema.json into isolated temp dirs (never the committed sdk/), normalizes a documented allowlist of cosmetic diffs, and exits non-zero on any un-allowlisted diff. (Add gen-sdk vs legacy SDK comparison engine and compare-sdk command #2288)
• Emits a structured report (per-file hunk counts + sample hunks) to the job log and $GITHUB_STEP_SUMMARY (Add shadow-gen diff as a central reusable CI workflow #2300). The downloadable artifact was dropped: the step summary renders the same markdown on the run page.
• make compare_sdk_<lang> runs locally (Add make compare_sdk_<lang> target to the bridged Makefile template #2290); a non-blocking, parallel CI job runs on every bridged provider's PRs and pushes, informational during the migration (Add shadow-gen diff as a central reusable CI workflow #2300). Hosted centrally as a reusable workflow. (A scheduled run was deemed unnecessary: the tooling is temporary and the dependency-bump PRs that can change either side already exercise it.)

Out of scope: cross-provider aggregate parity (% per provider/language). The tool stays per-provider, per-language. Once this job is rolled out everywhere, aggregate parity is collected from the per-repo workflow results by a separate script, tracked in #2287.

Self-contained: independent of the codegen fix (it only reports the diff).

Part of pulumi/home#4787.

Interim path: compare against tfgen's per-language schema

The shipped tool feeds gen-sdk the canonical schema.json, which assumes the end-state fix where gen-sdk resolves the chooser markup itself. That fix is further out (#2240), so the parity here sits at 7-35%, dominated by the leak. The shorter interim path is to have tfgen emit a per-language schema (tfgen <lang>-schema, pulumi/pulumi-terraform-bridge#3487) with the markup already resolved, and render from that. The existing --schema-cmd hook is the seam.

• compare-sdk runs the per-language schema emitter and feeds it to gen-sdk, reporting parity per provider/language.

[pose]

Scoping update: dropping the --all aggregate-parity criterion from this ticket and keeping the tool per-provider, per-language.

Rationale: once the compare_sdk_<lang> job is rolled out to every provider repo, an aggregate parity view (% per provider/language) is best produced by a small separate script that collects the per-repo results from their GitHub Actions runs, rather than by teaching this tool to compare every provider in one place. The latter would force the tool to obtain every provider's schema.json and legacy codegen binary itself (clone and build all providers), which is expensive and just duplicates what each provider's CI already does.

The cross-repo aggregation is tracked separately as #2287. I've updated the acceptance criteria here accordingly.