ci: detect stale recipe regeneration output

[fredericoo]

Context

From Kara's proposal in #headless-dev:

Right now even if someone makes a quick change, I'm always like :sus: when reviewing PRs that have massive diffs in the recipe files, because I never know if I can trust the output or not

Problem

Recipe regeneration produces large diffs that are impossible to review by eye. Reviewers have no way to verify whether the committed recipe files match what the generator would produce from the current source.

Proposed solution

Add a CI step that:

1. Runs recipe regeneration and all other file-updating commands
2. Checks for unstaged changes via git diff --exit-code
3. Fails the build if recipe files differ from what's committed

Acceptance criteria

• CI step runs recipe regeneration
• Build fails with a clear error message if recipe output differs from committed files
• Error message tells the author exactly which command to run