ci(gen): add apidiff exported-API gate

[cbrgm]

What

Add an apidiff gate that fails the build on any change to the exported API of ./githubevents.

• scripts/apidiff.sh compares the PR's package API against the base branch via golang.org/x/exp/cmd/apidiff
• make tools installs the pinned dev tools (gofumpt + apidiff), make apidiff runs the check
• CI installs tools up front and runs apidiff after the tests

Stacked on #278. Review/merge that first.

Why

The package is used in production and re-exports go-github's event types, so an accidental exported-symbol change is a real risk. This gate makes any such change a hard CI failure -> the modernization PRs that follow are provably API-neutral.

One thing worth calling out: the gate will (correctly) flag a go-github major bump as incompatible, because the event type identities (*github.MetaEvent etc.) really do change for consumers. That's intentional and honest. It means go-github major PRs get a human ack rather than silent auto-merge. Since this gate isn't on main yet, #277 can still merge cleanly in the window after phase-1 lands.

Testing

• renamed New -> NewX locally -> make apidiff fails with Incompatible changes: New: removed, exit non-zero
• reverted -> >> API compatible, exit 0
• apidiff pinned to a fixed version so the output-wording grep can't silently drift

Checklist

• Tests added/updated (the gate itself is the test; verified fail + pass)
• No breaking changes (tooling/CI only)
• Readable commit history (1 commit)
• AI code review considered and comments resolved