Implements the broad, read-only schema-backed scan for dot kde diff:
walks every (rcfile, group, key) reachable through the kcfg mapping
table, compares live values against their schema-declared defaults,
and reports each mismatch tagged declared or undeclared. Never writes.
Also fixes dot kde completions, which only ever offered save/help —
apply (added in a prior task) and diff were both missing.
