fix(scripts): pi-diff was silent about vendored shared modules

.pi/extensions/_shared/ is installed by deploy-scenario.sh from shared/extensions/
and is not in the scenario's workspace/, so pi-diff listed it as merely
"UNTRACKED in live workspace" -- no comparison at all. The file most likely to
drift, because it is the one shared between scenarios, was the one the diff had
nothing to say about.

Now compared against shared/extensions/ and reported like any other file, with a
missing source called out separately.

Also fixes the counter: the new branch incremented a variable named `changed`
while the summary reads `DIFFS`, so a detected difference printed a diff and then
claimed the installation agreed, and exited 0. Verified by planting drift: exit 1
and "1 difference(s) found", then 0 after redeploying.

scripts/pi-diff.sh

@@ -92,6 +92,22 @@ diff_scenario() {
       .ccgram-uploads/*|*/__pycache__/*|*/.venv/*|.venv/*|*.pyc|*.bak-*|\
       telegram-gateway/*|download.html|.pi/launch.json|*.log) continue ;;
     esac
+    # Vendored shared modules are installed by deploy-scenario.sh and are not in
+    # the scenario's workspace/, so compare them against shared/extensions/
+    # instead of reporting them as untracked -- otherwise the one file most
+    # likely to drift is the one the diff stays silent about.
+    case "$rel" in
+      .pi/extensions/_shared/*)
+        mod="${rel#.pi/extensions/_shared/}"
+        src="$REPO_ROOT/shared/extensions/$mod"
+        if [ ! -f "$src" ]; then
+          untracked+=("$rel (no longer in shared/extensions)")
+        elif ! diff_file "$src" "$workspace/$rel" "$rel (vendored from shared/extensions)"; then
+          DIFFS=$((DIFFS + 1))
+        fi
+        continue
+        ;;
+    esac
     [ -f "$dir/workspace/$rel" ] || untracked+=("$rel")
   done < <(cd "$workspace" && find . -type f -printf '%P\n' | sort)