feat(skills): wire drift check into every framework skill's pre-flight

[potiuk]

Summary

Follow-up to #40. Wire the drift-detection mechanism into every framework skill's pre-flight, alongside the override-consultation hook from #39. Each of the 15 framework skills (excluding setup-steward, the bootstrap + drift mechanism itself) now carries a ## Snapshot drift section right after its existing ## Adopter overrides section.

Standard block inserted

## Snapshot drift

Also at the top of every run, this skill compares the
gitignored `.apache-steward.local.lock` (per-machine
fetch) against the committed `.apache-steward.lock`
(the project pin). On mismatch the skill surfaces the
gap and proposes
[`/setup-steward upgrade`](../setup-steward/upgrade.md).
The proposal is non-blocking — the user may defer if
they want to run with the local snapshot for now. See
[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection)
for the full flow.

Drift severity:

- **method or URL differ** → ✗ full re-install needed.
- **ref differs** (project bumped tag, or `git-branch`
  local is behind upstream tip) → ⚠ sync needed.
- **`svn-zip` SHA-512 mismatches the committed
  anchor** → ✗ security-flagged; investigate before
  upgrading.

The block is identical across all 15 skills (the link target is the same — setup-steward/upgrade.md — for every skill).

Skills updated (15)

Setup family	Security family	PR-management family
setup-isolated-setup-install	security-issue-import	pr-management-code-review
setup-isolated-setup-update	security-issue-import-from-md	pr-management-stats
setup-isolated-setup-verify	security-issue-import-from-pr	pr-management-triage
setup-shared-config-sync	security-issue-invalidate
	security-issue-sync
	security-cve-allocate
	security-issue-deduplicate
	security-issue-fix

Not updated: setup-steward — it IS the bootstrap + upgrade + verify + override-management skill; the drift check it would perform is the same one its verify sub-action already exposes.

Test plan

• All prek run --all-files hooks pass (markdownlint, typos, doctoc, check-placeholders)
• Every framework skill except setup-steward has the ## Snapshot drift section (visual grep — 15/15 covered)
• Insertion point is consistent: directly after each skill's ## Adopter overrides block, before the next ## heading (Golden rules / Inputs / Prerequisites depending on the skill)
• CI link-check (lychee) passes

Out of scope

• Mechanical enforcement of the drift check (currently a documented convention, not a runtime injector). Future tooling — e.g. a sentinel pre-flight pre-commit hook on framework skill files — can verify each skill carries the section. Beyond this PR.

🤖 Generated with Claude Code