[Change] Patch mode for backlog/spec edits (previewable, confirmable) — Δ2

[djm81]

Why

Reporting findings is not enough; teams love tools that propose fixes they can safely apply. A patch pipeline that generates unified diffs for backlog body updates, OpenSpec proposal/spec updates, and config updates—with --apply (local) and --write (upstream) gating and idempotency for posted comments/updates—ensures zero accidental writes and trust by design.

What Changes

• Add a patch pipeline that generates unified diffs for: backlog issue body updates (AC, missing fields), OpenSpec proposal/spec updates, config updates (policy config, mapping templates).
• Add --apply + --write gating: default = generate patch only; --apply = apply locally; --write = push to GitHub/ADO only with explicit confirmation.
• Add idempotency for posted comments/updates (no duplicates).
• CLI: specfact backlog refine --patch emits a patch file and summary; specfact patch apply <patchfile> applies locally with preflight check; specfact patch apply --write updates upstream only with explicit confirmation.

Acceptance Criteria

• specfact backlog refine --patch emits a patch file and summary.
• specfact patch apply <patchfile> applies locally with a preflight check.
• specfact patch apply --write updates upstream only with explicit confirmation.

---

OpenSpec Change Proposal: patch-mode-preview-apply