fix(review): reserve header length in buildUnifiedReviewDiff's no-patch branch

[shin-core]

What & why

buildUnifiedReviewDiff builds a size-bounded unified diff for review. The patched-file branch already reserves the header's length against the remaining budget before appending:

if (header.length + body.length + 2 > remaining) {
  body = keepHighSignalHunks(file.patch, remaining - header.length - 4 - truncationNotice.length);
}

The no-patch branch (binary or too-large files) did not — it appended header + suffix unconditionally:

if (!file.patch) {
  diff += `${header}(no inline patch — binary or too large)\n\n`;
  continue;
}

Because the header interpolates file.path, a long enough path makes header.length + suffix.length exceed the file's remaining budget, and the returned diff overflows budget. That breaks the same bounded-output invariant the patched branch upholds — the one asymmetry between the two branches' budget handling.

The fix

Mirror the patched branch's reservation in the no-patch branch: check header.length + suffix.length against remaining before appending, and when it doesn't fit, fall through to the same truncation-notice-and-break path the loop already uses for the remaining < 240 case — rather than silently overflowing budget or silently dropping the file with no visible signal.

if (!file.patch) {
  const suffix = `(no inline patch — binary or too large)\n\n`;
  if (header.length + suffix.length > remaining) {
    diff += truncationNotice;
    break;
  }
  diff += `${header}${suffix}`;
  continue;
}

Unchanged: the patched-file branch's existing logic, and the common case — a patch-less file whose header+suffix fits comfortably renders byte-for-byte as before ("${header}(no inline patch — binary or too large)\n\n"). This is an edge-case fix for a long file.path only.

Tests (test/unit/review-diff.test.ts)

Extends the existing #10017 budget-invariant suite:

• True branch (the fix): a patch-less file with a ~250-char path and budget: 250 — remaining clears the < 240 floor but header + suffix (~310) overflows it. Asserts the returned diff's .length <= budget, the truncation notice is present, and the overflowing file was not appended. Fails on main (returns 308 > 250).
• False branch (regression): a short-path patch-less file with a comfortable budget still renders exactly "### logo.png (added) +0/-0\n(no inline patch — binary or too large)\n\n" with no truncation notice.

Validation

• Diff line + branch coverage on src/review/review-diff.ts is 100% — both arms of the new header.length + suffix.length > remaining check are exercised (lcov BRDA confirms taken=true and taken=false).
• npm run typecheck clean; npm run engine-parity:drift-check passes (the DIFF_FILE_PRIORITY twin markers are untouched — 7 pairs agree); npm run dead-exports:check, manifest:drift-check, docs:drift-check clean.
• git diff --check clean; no schema / migration / generated-artifact change.

Closes #10327

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.