chore(ci): add manifest-drift check for bundled fallback vs .gittensory.yml

[JSONbored]

Context

src/config/gittensory-repo-focus-manifest.ts embeds GITTENSORY_REPO_FOCUS_MANIFEST_YAML, a bundled fallback used when the real root .gittensory.yml isn't reachable (local dev, pre-merge branches). Its header comment says "Keep aligned with .gittensory.yml at repo root" — today the two are confirmed byte-for-byte identical, but nothing in the entire test:ci chain enforces this (confirmed by grepping all 24 scripts under scripts/*.mjs for either string — the only hits are unrelated prose in check-docs-drift.mjs). The only thing keeping these in sync is a code comment.

Requirements

1. Add a new script scripts/check-manifest-drift.mjs, following the existing check-*-drift.mjs naming/structure convention (e.g. check-docs-drift.mjs, check-schema-drift.mjs).
2. Parse the real root .gittensory.yml and the GITTENSORY_REPO_FOCUS_MANIFEST_YAML constant (via the yaml package, already a project dependency and already used in src/selfhost/private-config.ts/config-lint.ts — prefer this over js-yaml, which appears to be an unused transitive entry in package.json), deep-compare the two parsed objects, and fail with a clear diff-style message on mismatch.
3. Wire the new script into test:ci (add npm run manifest:drift-check next to the existing npm run docs:drift-check step).

Deliverables

• scripts/check-manifest-drift.mjs.
• A new package.json script entry and test:ci chain insertion.
• Test coverage for the check itself (matching the existing check-docs-drift.mjs test pattern, if one exists).

Expected outcome

Any future edit to .gittensory.yml that isn't mirrored into the bundled fallback constant (or vice versa) fails CI immediately with a clear diff, instead of silently drifting until a maintainer happens to notice.

[linear-code]

JSO-3132