id-driftlisted

# id-drift — the recurring drift sentinel (infra-delivery, post-spine) The `infra-delivery` step sequence (a documented procedure this skill family forms — no workflow engine or state-machine file ships) drives an infra change → merge. After that spine, `id-drift` is the **recurring** step — a forever **drift sentinel** that re-runs the **empty-plan seam** (`tofu plan == ∅`) on a **cadence** (continuous and/or scheduled) to compare **reality vs the merged IaC**. It is the cadence-generalization of `id-baseline`: `id-baseline` proves drift-free **once** (at adoption); `id-drift` proves it **forever** (on every tick). The empty plan doubles as the forever drift check. To detect drift it runs a **read-only `tofu plan`** — the active stack profile's **`infra_binding.plan`** command. It then reads the **per-resource plan delta** from the BUILT canonical parser **`foundry_plan_model.parse_actions_detail`** and frames the result: - **The empty-plan seam (`tofu plan == ∅`, `actions_detail == []`) ⇒ DRIFT-FREE** — reality equals the merged IaC. - **The DRIFT (non-empty-plan) branch (`actions_detail != []`) ⇒ DRIFT — surface the diverging resources** (the `parse_actions_detail` per-resource `actions_detail`) and **hand them to `id-sync`/`id-rollback`** (the reconcile/revert consumers). It **NEVER auto-reconciles** — detection is read-only; the operator (via `id-sync`/`id-rollback`) decides the fix. The same empty-plan predicate `id-baseline`/`id-import` accept on is REUSED — not