Automation
CI pipelines
Run a sync check on every change and report drift to the registry.
`wl sync --check` writes nothing and fails on drift, so any CI system that can run the CLI can gate on it. With --report and --registry-url it sends the drift status to the registry.
For registry calls the CLI takes a token from --token, then the WORKLOOM_TOKEN environment variable, then a stored token. `wl ci-token --workspace <id>` mints a token scoped to one workspace with the reader role.