feat: diagnose target adapter ownership drift

[levifig]

Summary

• Add one read-only, non-fixable doctor check that inspects recorded OpenCode, Cursor, Codex, and Amp ownership manifests and every declared adapter artifact.
• Fail closed for detected legacy installs, malformed or missing records/manifests, unsafe or symlinked paths, missing or drifted content/projections/modes, and version-incoherent state; report all defects in deterministic target/artifact order.
• Compare current versions only when the executing binary proves its Loaf distribution root, preventing caller working trees from creating or hiding drift.

Containment

This PR is stacked on #108, which is stacked on #107. It does not add repair, source-to-build comparison, capability or smoke-freshness diagnostics, legacy Amp cleanup, or real installed dogfood. No real global Loaf install or target configuration was mutated.

Verification

• LOAF_VALIDATE_TYPESCRIPT=1 npm run build
• go test ./internal/cli ./internal/state -count=1
• go vet ./...
• npm run typecheck
• npm run test
• bin/loaf change check --require-executable docs/changes/20260710-journal-reliability-foundation/change.md
• bin/loaf check --hook check-secrets
• bin/loaf check --hook security-audit
• bin/loaf check --hook render-drift
• bin/loaf check --hook ephemeral-provenance
• bin/loaf check --hook validate-commit
• Claude 2.1.207 startup smoke through a disposable PATH shim to the retained pinned binary; the global 2.1.208 symlink was not changed
• Codex 0.144.1 isolated startup smoke
• OpenCode 1.17.18 isolated request-delivery smoke
• Independent final review: APPROVE, no findings