Make --check graphviz-version-independent; guard both committed diagrams in CI

[inth3shadows]

What

--check byte-compared the rendered SVG, which is graphviz-version-specific, so it false-failed whenever the committed image and the checking machine used different graphviz builds (this repo's committed diagrams are graphviz 15.0.0; ubuntu-latest apt ships 2.42.2). That made the drift-guard unusable in CI — the exact place it was built for. Its own code even hedged this ("the same-generator caveat every regenerate-and-diff artifact check carries").

Fix: for svg output, --check now compares the graph structure — the sorted set of node ids and directed edges, parsed from the SVG's <title> elements — instead of raw bytes:

• Graphviz-version independent (titles are the semantic ids; layout/version stamp are ignored).
• Order-insensitive (codegraph's enumeration order isn't guaranteed stable run-to-run).
• Fails only on structural drift (a caller/callee/edge appearing or disappearing); a cosmetic-only change with the identical graph is tolerated by design.
• Non-svg formats keep the byte-compare and its documented same-version caveat.

No new flag, no new committed artifact type. ~67 lines (svgStructure, decodeXmlEntities).

Dogfood it — new diagrams CI job

Installs codegraph (pinned @1.4.1), builds a fresh index, and runs --check on both committed diagrams, so a PR that changes the code but not the diagram fails.

Note for reviewers: this is the first CI job that installs codegraph + builds an index. If that step is flaky on GitHub's runners, the intended fallback is continue-on-error: true (advisory instead of blocking). Watching this PR's diagrams job is the real test of codegraph-in-CI.

It immediately caught real rot

docs/buildDot-callgraph.svg was already stale — missing the nodeIdentities node/edge that #13 added to buildDot, because nothing ever re-checked it. Regenerated it, wrapped it in codeshot:buildDot markers so it's now guardable, and fixed the now-wrong "five callees" prose in TECHNICAL.md.

Tests

83 pass (was 77). New tests cover entity decoding, order-insensitivity, attribute-order tolerance, cosmetic-vs-structural drift, and a real dot -Tsvg render whose parsed structure is asserted against the DOT — proving the parser matches actual graphviz output.