feat(scripts): pre-commit hook + CI gate for compliance drift

Wire pnpm compliance:emit-all into the pre-commit hook (conditional on
staged Payload configs, library traces, or compliance/ files) and add a
hard-fail compliance drift check step to the CI validate job positioned
after pnpm conformance.

Also fix emit-all.mjs: it previously hardcoded --check on every invocation,
so it never actually regenerated artifacts. Now the default mode writes and
--check mode diffs only — matching the pre-commit (write) vs CI (check) split.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -65,6 +65,14 @@ jobs:
       - run: pnpm typecheck
       - run: pnpm lint
       - run: pnpm conformance
+      - name: Compliance manifest drift check
+        run: |
+          pnpm compliance:emit-all --check || {
+            echo ""
+            echo "Compliance artifacts are out of date."
+            echo "Run \`pnpm compliance:emit-all\` locally and commit the updated files."
+            exit 1
+          }
       - name: Fallow whole-codebase analysis
         run: pnpm fallow --format annotations
       - run: pnpm turbo boundaries