diffUpdate inserted an element at its target index without removing it
from its previous index, so a pure permutation like [d,a,b,c] ->
[a,b,c,d] left every misplaced element in the model twice and the
removal pass never reclaimed them because their pointer is still in
newValues. Any caller that re-sorts an existing list (dbusmenu
re-layout, desktopentry re-scan) can hit this. Found via a downstream
niri workspace backend where a monitor hot-plug re-sorts the model.
