Function render_diff 

pub fn render_diff(
    diff: &DiffReport,
    baseline_hint: Option<&str>,
    probes: &[&dyn PlatformProbe],
) -> String

Render a standalone diff report as Markdown.

Schema:

• # AgentSec diff vs <baseline-path-or-"latest snapshot"> — header.
• If the diff is empty, a single _no changes._ line and nothing else.
• Otherwise the three ### Added / ### Modified / ### Removed subsections, each omitted when its vector is empty.
• Lines whose inventory category is security-critical are prefixed with 🚨 **CRITICAL**; within each section, critical entries appear before non-critical entries (highest-severity first).

Pass baseline_hint as Some("/path/to/snapshot") to put the snapshot path in the header, or None for the generic phrasing.