fix(diff): stop aborting on documents containing wide characters

[Harsh-2002]

mdx diff aborts with a core dump on any document containing a wide character. Found while smoke-testing every command against the published v1.5.0 binary.

$ mdx diff notes.md README.md
thread 'main' panicked at src/diff.rs:104:28:
end byte index 35 is not a char boundary; it is inside '✅' (bytes 33..36)
Aborted (core dumped)

panic = "abort" is set in the release profile, so this is a SIGABRT and a core dump, not a message. Diffing this repo's own README triggers it — the parity table is full of ✅.

Two bugs, one line apart

fn truncate(s: &str, max: usize) -> String {
    if s.len() <= max { ... }              // len() is BYTES
    else { format!("{}...", &s[..max - 3]) }   // byte slice → panic
}

The crash: &s[..max - 3] slices at a byte offset that can land mid-character.

The misalignment, present even without the crash: the guard measures str::len (bytes) while the column padding uses {:<width$} (chars). Neither is display width, so a line of CJK or emoji puts the | separator in the wrong column — a wide character occupies two terminal cells but counts as one char and three bytes.

The fix

Truncate and pad by display width, reusing src/text.rs, which already had display_width and pad_to_width. It also already had this exact truncation function under a URL-specific name — truncate_url is now truncate_to_width, with truncate_url delegating so its callers are untouched.

Tests

diff had no tests at all, which is how this survived. 324 → 331.

• Wide characters across three scripts, 200 consecutive ✅, and mixed emoji — each asserted to exit cleanly
• Empty files, identical files, --unified
• Unit tests on truncate_to_width: never splits a character at any width from 0 to 12, counts display columns rather than bytes or chars, marks the cut

Scanned for siblings

This is the second byte-slicing crash of this class (after publish.rs), so I swept the source for the pattern. Every other case either takes its index from find() — which returns a char boundary — or already goes through char_indices().nth(). search.rs::truncate_chars and publish.rs::truncate_description are both correct. diff.rs was the last one.