[ACT-002] GitHub Action drift mode

[Hacks4Snacks]

Roadmap priority: P2

Goal: Detect pull requests where architecture-relevant code changed but no threat model changed.

• Add configurable watched-path and model-path globs.
• Support off, notice, and fail; default to advisory notice.
• Emit structured outputs and a step summary before adding comment permissions.
• Handle pushes, shallow clones, deleted/renamed files, and fork pull requests safely.
• Make PR comments idempotent with a hidden marker.

---