[Feature]: Snapshot comparison to distinguish renewals from material certificate changes

[bradh11]

Pre-flight checklist

• I have searched existing issues to make sure this feature hasn't been requested
• I have read the documentation to ensure this feature doesn't already exist
• This feature aligns with the project's goals and scope

Problem Statement

Recurring scans produce independent snapshots. fingerprint_sha256 tells you a certificate changed, but not what changed: a routine renewal from the same issuer with the same SANs and key type is fine, while a new issuer, a dropped SAN, or a weaker key is worth an alert.

Proposed Solution

A compare(previous, current) helper (and certmonitor diff command) that takes two get_cert_info() or check --json outputs and reports renewals versus material changes: issuer, subject, SAN set, key algorithm and size, signature algorithm, validity window, and fingerprint.

Feature Category

API enhancement

Use Case

A nightly job stores the JSON report; the next run diffs against it and pages only when something other than dates and serial number changed.

Implementation Ideas

Pure-Python comparison over the existing structured dictionaries; no new data collection needed.

Priority

Medium - Would be helpful

Additional Context

Follows the fingerprint feature in 0.5.0; targeted for 0.6.