feat: add cascade verify command to detect workflow drift

[joshua-temple]

Problem

Generated workflows are marked cascade-owned, but nothing lets a user prove a committed workflow still matches what its manifest would generate. The only drift check today is a hand-rolled regenerate-and-diff step in CI. Closes #177.

Fix

A new read-only cascade verify command. It regenerates from the manifest in memory and compares against the committed .github/workflows files byte-for-byte, reporting per-file drift.

Keystone refactor: a side-effect-free generate.Plan(opts) is now the single source of truth for the generated file set and content, consumed by both generate and verify, so the two cannot diverge. Existing generate output stays byte-identical.

Exit-code contract (follows diff):

• 0 no drift
• 1 drift detected (a generated file is missing or its bytes differ)
• 2 error (manifest missing or invalid, or another failure)

Scope is plan-set-only for now; flagging stray cascade-owned files no longer in the plan is a separate follow-up.

Verification

• Unit tests cover clean/changed/missing/non-cascade-ignored/manifest-absent/quiet and the 0/1/2 mapping.
• TestPlan_MatchesGeneratedBytes asserts Plan equals exactly what generate writes across a multi-env fixture; generate golden and determinism tests stay green.
• e2e scenario 22-verify-drift (generate -> verify 0, mutate -> verify 1, regenerate -> verify 0).
• go build ./... && go test ./... && golangci-lint run ./... green; e2e module builds and vets.
• Independent review: APPROVE.