Provider Ops comms + gen-sdk migration demo

[pose]

Context

Part of the gen-sdk migration epic, pulumi/home#4787. Before the first gen-sdk flips, Provider Ops needs to understand the new comparison ("shadow-gen diff") CI job and the new class of failure/warning messages it surfaces; and we want a working-backwards demo of the target maintainer experience.

Acceptance criteria

• Provider Ops briefed on the shadow-gen diff check: what it does, what a failure looks like, how to triage (real diff vs allowlisted-cosmetic), and the soft-fail regression-guard behavior during the 2-week cooldown.
• A short runbook/FAQ entry for the new diff failures, linked from the provider-ci docs.
• An end-to-end demo (recording or live script) of one provider+language flip: compare green → set useXPackageGenSdk: true → make ci-mgmt && make generate → PR gate passes → identical SDK. (Mirrors the announcement demo script in the design doc.)

Depends on #2281 (sdk-hooks.mk) and #2282 (comparison tooling).

Part of pulumi/home#4787.