Add infisical secrets diff to compare secrets across environments/paths #330

Problem

There is currently no built-in way to compare secrets between two environments (or two paths) to see what's added, removed, or changed before promoting a change (e.g. staging → prod). Users end up hand-rolling this with infisical export twice plus diff/yq/manual comparison, which is error-prone and doesn't mask sensitive values by default.

This is a recurring, real pain point — see the related discussion on drift/promotion-safety in the main Infisical repo (Infisical/infisical#905) — and none of the comparable secret-management CLIs I checked (Doppler, 1Password, Vault) ship a native diff either, so this would be a meaningful differentiator.

Proposal

Add infisical secrets diff, e.g.:

infisical secrets diff --env=staging --env2=production [--path=/] [--projectId=...] [--show-values]

• Fetches secrets for both environments/paths using the existing GetAllEnvironmentVariables-style fetch path (already used by run/export).
• Prints a table of added / removed / changed keys.
• Values are masked by default (consistent with the recent masking fix for secrets set output); --show-values reveals them.
• Reuses the existing table-rendering helpers in packages/visualize.

Scope

This only touches a new command file (packages/cmd/secrets_diff.go or similar) plus tests — no changes to existing commands, storage, or API client beyond calls already exposed. Happy to open a PR.