No safety net today catches a version bump that silently changes
cryptographic output for existing inputs — semver numbers alone don't
verify actual behavior. Add differential.ts: it installs the pinned
reference version (vN-1, named in differential.config.json) into a
throwaway directory, runs every vectors/stellar.json fixture through both
that build and the workspace tip via the shared differential-runner.mjs,
and diffs the outputs field by field. Unwaived diffs fail the run; waivers
in differences.json require a non-empty reason and the script refuses to
run without one.

Running the harness for real against the pinned reference (1.3.0) surfaced
two genuine issues:

- generateStealthAddress's default view-tag scheme changed (legacy prefix
  to the domain-separated v2 prefix) in commit f7def68 (PR wraith-protocol#93), before the
  1.4.0 minor, without a major bump. This is a real, already-shipped
  protocol change — documented and waived in differences.json with the
  commit reference, exactly the kind of entry this file exists to hold.
- signWithScalar had a leftover debug `console.log` that wrote to stdout on
  every signing call, corrupting the runner's JSON-over-stdout protocol
  (and explaining the stray "SCALAR:" noise in the existing test output).
  Removed it.

Wire a `differential` job into ci.yml that runs on every PR touching
src/chains/** (via dorny/paths-filter) and unconditionally on push to
main/develop, so the acceptance criterion of a green run on develop is
checked directly rather than assumed.

Closes wraith-protocol#132