feat(ci): detect caller-template drift (DEC-080)

[omar-nahhas]

Closes C5.

make link-workflows copies the caller templates into a consumer, and devkit-sync deliberately never writes .github/workflows/. So the vendored devkit advances while the copied caller stands still — and nothing at runtime notices. Both known instances were silent by construction:

• share-chat could not reach the capture_all_traces input for weeks; no run ever failed to say so
• actions: write (DEC-074) needed hand-propagating to 4 repos in 4 PRs, and until then the prune degraded to a warning rather than failing

What counts as drift

Compares the executable contract — triggers, dispatch inputs, permissions, job ids, uses refs, with inputs, secrets shape. Ignores comments, whitespace, quoting, key order, prose descriptions.

That line is deliberate: a byte-diff would have fired on all four consumers the moment the devkit rewrote a header comment for DEC-079, and a checker that cries wolf gets || true'd.

Templates resolve to the consumer's own pinned tests/_testkit when available, so each repo is judged against the devkit ref it pinned.

The self-test is the point

It replays both real incidents as positive controls, and pins the cosmetic tolerances as negative controls — so the tempting fix for a noisy checker (loosen until quiet) fails the suite instead of passing silently. 10/10 green.

Verified against live main

repo	result
chat-comments	in sync
diff-visualizer	in sync
mermaid-diagrams	in sync
share-chat	4 drifted paths — capture_all_traces input + its with: wiring

Fixing share-chat separately.