Add CI job for PRs which diffs the built output

[gsnedders]

We should probably allow the last few lines to change, given new builds may get uploaded, but changing anything earlier should probably require an explicit override (be it an admin-merge or otherwise).