feat(demo): show the seeded change before pushing it

The run tab said a defect was seeded and then moved on. The audience had to
take on trust both that a change was made and that the diagnosis Hermes
produced two minutes later actually matched it. Printing the diff first closes
that gap: they watch the wrong line go in, then watch a model find the same
line without being told where it is.

Placed before the commit rather than after the push because this is the only
moment in the demo where a human changes any code, and it is worth being seen
as such. The short sha follows the push so the commit on screen can be matched
to the one Jenkins builds.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/ops/hermes_code_demo.sh

@@ -156,8 +156,20 @@ if old not in s:
     raise SystemExit("defect already present or file changed; run reset first")
 p.write_text(s.replace(old, new))
 PY
+  )
+
+  # Shown before the push, not after: the audience should watch the defect go
+  # in rather than take on trust that the later diagnosis matched it. It is
+  # also the only moment in the whole demo where a human changes any code.
+  say "The change about to be pushed"
+  note "$ git diff -- src/discount.py"
+  ( cd "$CODE_REPO_DIR" && git --no-pager diff --unified=2 -- src/discount.py ) |
+    sed 's/^/        /'
+
+  ( cd "$CODE_REPO_DIR" &&
     git commit -qam "refactor: simplify discount percentage math" && git push -q origin master )
-  note "pushed: a plausible-looking change that breaks three regression tests"
+  note "pushed $(cd "$CODE_REPO_DIR" && git rev-parse --short HEAD) to master"
+  note "a plausible-looking change that breaks three regression tests"
 
   say "Running the test gate -> build #$next_num"
   note "HTTP $(jenkins_post "/job/$CODE_JOB/build")"