feat(diff): log the diff report URL and cover discovery memory

PR/MR runs logged the head and new scan IDs but no link to the result, so a CI log
gave no way to reach the report. Log the diff report URL where it is computed, so
every diff flow gets it rather than only the full-scan-only branches.

Also add a regression test asserting manifest discovery's peak allocation stays
bounded by the widest single directory and the result set rather than by repository
size. Measured against the per-pattern rglob approach this replaced, on a tree of
59,300 files including one 50,000-entry directory: 3.25 MB peak vs 10.72 MB.
os.walk keeps a list of names per directory where rglob materialised DirEntry
objects and a Path per candidate, so the single-pass walk allocates strictly less.

Ref: CE-379

Author: lelia

socketsecurity/core/__init__.py

@@ -1970,6 +1970,10 @@ def create_new_diff(
         else:
             diff.diff_url = diff.report_url
 
+        # PR/MR runs previously logged only the scan IDs, so a CI log had no link to the
+        # result. Logged here rather than at each call site so every diff flow gets it.
+        log.info(f"Diff report URL: {diff.diff_url}")
+
         return diff
 
     def create_diff_report(

tests/unit/test_manifest_discovery.py

@@ -303,3 +303,29 @@ def test_core_initialization_logs_organization_timing(caplog):
         "Organization initialization completed" in record.message
         for record in caplog.records
     )
+
+
+def test_discovery_does_not_build_a_repository_sized_index(tmp_path):
+    """Peak memory must stay bounded by the widest directory and the result set, not
+    by repository size. This is the property that keeps discovery viable on small
+    runners; the per-pattern rglob approach it replaced allocated strictly more.
+    """
+    import tracemalloc
+
+    wide_directory = tmp_path / "wide"
+    wide_directory.mkdir()
+    for index in range(20000):
+        (wide_directory / f"source{index:05d}.ts").write_text("x", encoding="utf-8")
+    (tmp_path / "package.json").write_text("{}", encoding="utf-8")
+
+    core = _make_core()
+    tracemalloc.start()
+    try:
+        found = core.find_files(str(tmp_path))
+        _, peak_bytes = tracemalloc.get_traced_memory()
+    finally:
+        tracemalloc.stop()
+
+    assert _relative_results(tmp_path, found) == {"package.json"}
+    # 20k files in one directory; a repo-sized index would be far larger than this.
+    assert peak_bytes < 8_000_000, f"peak allocation was {peak_bytes / 1e6:.1f} MB"