ci-driftlisted

# CI drift ## Overview Audit every workflow and its GitHub-side state against the live repo and ship the fixes as a PR. This is the ci-drift instance of `docs/patterns/audit-loop.md`: enumerate, verdict with evidence, apply on a branch, gate through a PR the operator approves. It catches what a single failing run cannot: a workflow silently disabled for days, an orphan secret/var nobody removed, a dispatch choice with no caller, a release check that trusts a sha alone. ## The four slots (per the audit-loop pattern) | Slot | This instance | |---|---| | Item set | every `.github/workflows/*.yml` + GitHub-side state: `gh api repos/<r>/actions/workflows` (enabled state), `gh run list -w <f> -L 1` (last run), `gh secret list` / `gh variable list` + per-environment secrets/vars via `gh api repos/<r>/environments`, `gh api repos/<r>/actions/runners`, `gh release list`, each environment's `deployment_branch_policy`, plus any cross-repo dispatcher the operator names | | Contract | every workflow is enabled or deliberately retired; every `secrets.X`/`vars.X` reference resolves, and the inverse (no orphan secret/var); every `runs-on` label has an online runner and no runner is untargeted; every `workflow_dispatch` input has a caller or a documented reason; no `paths:` filter names a deleted dir; release minting is prefix-scoped per workflow and has a retention step; production environments gate on the default branch only | | Evidence class | Tier 1: `gh api` + grep, mechanical. Tier