Flamegraph pass on diff core (follow-up to #29)

[Metbcy]

Context

PR #48 / issue #29 expanded benches/diff.rs to cover realistic SBOM shapes. We now have repeatable wall-clock numbers but no allocation profile or hot-path breakdown. The diff-core path is the one that has to stay snappy as bomdrift gets used on larger SBOMs (Kubernetes, ELK, monorepo build trees in the 5k–15k component range), and #41-style "diff is slow on big SBOMs" reports will land eventually.

Goal

A one-shot perf investigation that ends in either (a) one or more targeted patches with before/after numbers from benches/diff.rs, or (b) a documented "the current shape is fine, here's the floor" note so we have something to point at next time someone asks.

Proposal

1. Run cargo flamegraph --bench diff -- --bench (Linux) on the existing benchmark scenarios; save the SVGs as artifacts (don't commit them).
2. Run dhat/heaptrack (or cargo-heap) against the same bench to get allocation counts per scenario, focusing on the realistic-shape cases added in feat(bench): expand diff-core benchmark with realistic shapes (#29) #48.
3. Look for the usual diff-core suspects:
   • Redundant String allocations in diff/key.rs purl normalization
   • HashMap<String, …> keyed lookups where &str would suffice
   • Unnecessary clone() in the change-classification loop
4. Land patches that meaningfully move the needle (e.g. >10% wall or >20% alloc reduction on the 10k-component bench), or close as "no-op, current shape is the floor."

Out of scope

• Parser perf (separate bench, separate hot path)
• Render perf (separate bench)
• Async-ifying anything in diff/

Acceptance

• PR title carries the before/after numbers from benches/diff.rs, or
• This issue closes with a short comment summarizing what was measured + why no change shipped

References

• Add a criterion benchmark for the diff core #29 / feat(bench): expand diff-core benchmark with realistic shapes (#29) #48 (realistic-shape diff benchmark expansion)
• benches/diff.rs
• src/diff/mod.rs, src/diff/key.rs