ci-driftlisted

# CI drift ## Scope and triggers Enumerates every workflow + GitHub-side CI state (enabled/disabled, secrets, vars, runners, releases, environment policy), verdicts each against the live repo with evidence, fixes drift on a branch, gates through a PR. An audit-loop instance (docs/patterns/audit-loop.md). ## Overview Audit every workflow and its GitHub-side state against the live repo and ship the fixes as a PR. This is the ci-drift instance of `docs/patterns/audit-loop.md`: enumerate, verdict with evidence, apply on a branch, gate through a PR the operator approves. It catches what a single failing run cannot: a workflow silently disabled for days, an orphan secret/var nobody removed, a dispatch choice with no caller, a release check that trusts a sha alone. ## The four slots (per the audit-loop pattern) | Slot | This instance | |---|---| | Item set | every `.github/workflows/*.yml` + GitHub-side state: `gh api repos/<r>/actions/workflows` (enabled state), `gh run list -w <f> -L 1` (last run), `gh secret list` / `gh variable list` + per-environment secrets/vars via `gh api repos/<r>/environments`, `gh api repos/<r>/actions/runners`, `gh release list`, each environment's `deployment_branch_policy`, plus any cross-repo dispatcher the operator names | | Contract | every workflow is enabled or deliberately retired; every `secrets.X`/`vars.X` reference resolves, and the inverse (no orphan secret/var); every `runs-on` label has an online runner and no runner is untargeted; ev