feat(audit): flag unexpected resources (ok/unexpected + Reason); finish DynamoDB removal

[stevethomas]

Hey, I made a thing! 🥳

What problems are you solving?

Three things, all downstream of #80 (dropping DynamoDB sessions for Valkey):

1. yolo audit couldn't see the leftover DynamoDB table. After feat(sessions): drop DynamoDB, move sessions onto the Valkey cluster #80 deleted YOLO's DynamoDB support, the per-app sessions table still lives in AWS — and it's still tagged yolo:app=<live app>, so audit's ownership test read it as fine. Audit had no way to know YOLO had stopped provisioning that kind of resource.

   Audit now flags it. A resource carrying a YOLO ownership marker but of an AWS service YOLO no longer has a Resources/ class for is surfaced — driven by Audit::SERVICE_BY_RESOURCE_GROUP, whose keys mirror the src/Resources/* directories (enforced by ManagedServicesTest). So it's correct by construction: dropping a service directory auto-surfaces its leftovers, and a still-managed service is never false-flagged. yolo audit production now shows the DynamoDB sessions table as a teardown candidate.

2. Audit's status vocabulary was confusing — collapsed to two statuses + a Reason column. The original ok/drift/orphan/rogue taxonomy overloaded "drift", which already means attribute-level config mismatch in yolo sync. Audit is an ownership/inventory check — tags, ARN service, and whether the owning app's cluster is live — and it never inspects a resource's configuration. So it really has two outcomes:

   Status	Meaning
   ok	Accounted for.
   unexpected	In the env's tag namespace but not accounted for — see the Reason.

   The cause moves into a Reason column: no ownership tag (was rogue), service no longer provisioned (was orphan — the DynamoDB case), app cluster gone (was drift). A sentence beats a one-word label, and "drift" now means exactly one thing across YOLO. The --drift flag becomes --unexpected.

3. Finish scrubbing DynamoDB from the codebase. feat(sessions): drop DynamoDB, move sessions onto the Valkey cluster #80 left tombstones + one stale default: dropped the session.driver: dynamodb special-case in the manifest validator (the generic allow-list already rejects it) and its dedicated test; removed the DynamoDB absence-assertions from the IAM/env-step tests; fixed the yolo.yml stub that still advertised dynamodb as the default session driver, and the manifest-reference deprecation note.

Is there anything the reviewer needs to know to deploy this?

• No infrastructure change and no AWS mutations — this is audit classification logic plus docs/test cleanup. The check is pure (tags + ARN service + cluster liveness), unit-tested, and rides the existing Resource Groups Tagging API query.
• The leftover DynamoDB table is not deleted by this PR, by design — it now appears as unexpected / service no longer provisioned in yolo audit production; teardown is a manual aws dynamodb delete-table once confirmed.
• Detection covers whole-service removal (the DynamoDB case), not per-resource desired-state. Catching feature-toggle-off leftovers (e.g. an IVS channel after disabling IVS) would need every sync step — including the custom-orchestration ones (S3 bucket, queue alarms, certs) — to declare its resource; left as a follow-up to avoid false-flagging legit infra.
• 518 tests pass · phpstan clean · pint clean · VitePress build clean.

🤖 Generated with Claude Code