Drift status (check 1 of 2)

[crutkas]

Layered on top of #34 (the signed-copy drift guard). Please review and merge #34 first. When #34 merges, GitHub will auto-update this PR's base to main and it becomes mergeable on its own.

What this PR adds

A single new workflow: .github/workflows/drift-visibility.yml. It calls the shared comparator (src/tools/check-signed-drift.ps1, introduced in #34) on every PR — no paths: filter, so the check runs even for PRs that only edit src/. When any file drift exists between src/ and the top-level signed copies (Workloads/, windows-dev-config/, wsl-comfort/), the job exits non-zero and the check surfaces as a red ❌ entry named Drift status inside the PR's "Some checks were not successful" panel at the top of the conversation.

What this PR does not add

• No comparator changes — that script lives in Signed-copy drift guard (check 2 of 2) #34 and is the single source of truth.
• No badge, no Gist, no PAT, no schedule trigger, no sticky comments.
• No README change. The dev guide subsection (src/docs/development.md) is the only doc update.

Intended branch protection

This check is informational, not blocking. Do not add it to required status checks in main branch protection. Drift is expected during the window between a src/ change landing on main and the next sign-pipeline cycle catching up; the red ❌ is the awareness signal the user explicitly asked for ("I''m OK with drift, the issue is not knowing there is drift"). The companion Signed copy guard from #34 is the one that should be required.

Verification

Tested locally in a CI-emulating environment (fresh pwsh process spawned with the OS-level WorkingDirectory set to the workspace, matching how the GH Actions runner invokes shell: pwsh steps):

• Clean tree: comparator reports ok=30, drifted=0, missing_in_root=0, missing_in_src=0; workflow exits 0; job summary shows "✅ Signed copies in sync with src/. 30 file(s) checked. No drift detected."
• Single byte flipped in windows-dev-config/dev-config.winget (then reverted): comparator reports drifted=1; workflow exits 1; ::notice:: annotation emitted; job summary contains the markdown table:
  | windows-dev-config/dev-config.winget | drifted | bytes differ at offset 0 (src len=39522, root len=39522) |
• Post-revert verify: clean again, exit 0.

cc reviewers of #34 — same author/scope/intent.