Using LLMs to do security analysis at the git diff level — what works, what doesn't, and why structured output matters