Bound the blast radius of a proposal: reject wholesale rewrites by diff size

[Johin2]

Problem

safety.py inspects a proposal for dangerous operations: process spawning, sockets, filesystem access, eval/exec, globals tampering. Nothing bounds how much the model rewrites.

A proposer that responds to a one-line off-by-one bug with a 200-line reimplementation passes every gate we have, as long as the new code avoids blocked calls and the verifier goes green. Under --apply that lands on disk. The verifier only proves the given test passes; it says nothing about the behavior the rewrite silently dropped along the way. This is the failure mode most likely to erode trust in --apply, and it is invisible in the current output because the CLI prints the diff but never comments on its size.

Proposal

Treat diff size as a first-class safety signal.

• Add max_diff_lines (and/or max_diff_ratio relative to the original) to the safety config, checked against the unified diff before install. Exceeding it is a safety_violation event with a distinct reason.
• When more than one candidate verifies across attempts, prefer the smallest diff instead of the last one to pass.
• Surface the diff size in the CLI output so a large-but-allowed rewrite is at least visible.

Acceptance criteria

• A wholesale rewrite that passes the verifier is rejected under the default ceiling and reported as a safety violation, not a generic failure.
• The ceiling is configurable per safety level and can be disabled.
• Where several attempts produce passing candidates, the smallest diff wins.
• Tests cover: oversized rewrite rejected, small fix accepted, smallest-of-several selected.