v0.40.0

• Drift at the gate. The blueprint (paid side) writes one observation per declared service with what the GitOps repository declares against what the cluster runs. An edit to the manifest that declares a drifting service now raises a commit-tier finding naming the drift, with the observation's ref on it, under runtime.drift. Same cache, same rule: the gate never calls a cluster.