ci: add bundle vector drift gate

[jithinraj]

Summary

Add scripts/verify-bundle-drift.mjs - a robust drift detector for bundle conformance vectors.

Features

• Baseline/delta approach: snapshots working tree before regen, evaluates only regen-introduced changes
• Catches both tracked diffs AND untracked new files
• Windows compatible (pnpm.cmd, git.exe)
• Blocks --allow-dirty in CI (prevents false confidence)
• Validates regen only touches bundle directory (catches generator bugs)
• Uses git porcelain format for safe parsing

Exit codes

Code	Meaning
0	No drift (vectors deterministic)
1	Drift detected (vectors need commit)
2	Script error (regen failed, touched wrong files, dirty repo)

Usage

```bash

CI (clean tree required)

pnpm verify:bundle-drift

Local development (allows unrelated dirty files)

pnpm verify:bundle-drift --allow-dirty
```

Test plan

• CI passes
• Script exits 0 on clean tree
• Script exits 1 if vectors modified
• Script exits 2 if regen touches non-bundle files

Stacked PRs

1. PR1 -> main: kernel codegen + bundle error codes
2. PR2 -> PR1: audit dispute bundle verifier
3. PR3 -> PR2: crypto testkit subpath export
4. PR4 (this) -> PR3: CI drift gate

Merge in order: PR1 -> PR2 -> PR3 -> PR4