Drift checks in CI

`wl sync --check` reports without writing, so CI can run it, and a workspace can require it through its CI policy. Drift is classified into five drift classes, each a drift.* diagnostic.

With --report, the CLI sends the drift status (clean or dirty) to the registry, which raises a drift.detected or drift.cleared event for webhooks. `wl ci-token` mints a token scoped to one workspace for that pipeline.