ci: gate dogfood workflow drift and sync promote.yaml

[joshua-temple]

Problem

cascade dogfoods its own generated GitHub Actions workflows under .github/workflows/, but promote.yaml had drifted from generator output across several merged changes, and no CI check caught it:

• source_image_tag preflight output (missing)
• source_image_digest preflight output (missing)
• mode injected via env: instead of inline interpolation in the validate step (missing)

Fix

• Regenerated the dogfood workflows from .github/manifest.yaml with cascade generate-workflow --force. Only promote.yaml was stale (orchestrate.yaml and the manage-release composite action were already in sync). The synced file now carries the three items above.
• Added a Workflow Drift Check job to .github/workflows/pr.yaml that builds the CLI, runs cascade generate-workflow --config .github/manifest.yaml --force, then git diff --exit-code -- .github/workflows/ .github/actions/, so CI fails whenever committed dogfood workflows no longer match generator output. The job is wired into the PR Gate aggregate.
• Quoted a pre-existing word-split in the unit-tests step so the file passes actionlint cleanly.

Verification

• Generation is deterministic (identical across repeated runs, no embedded timestamps); generated file content contains no machine-specific paths.
• Gate proof: on the synced tree the gate command exits 0; on a deliberately drifted commit (a generated line removed) the same command exits non-zero, then exits 0 again once restored.
• go build ./... && go test ./... green (1231 tests), golangci-lint run ./... clean, actionlint .github/workflows/pr.yaml exit 0.

New required action pins reuse the existing repo-pinned SHAs for checkout and setup-go.