Policy Drift Detector
Detects policy/config drift across runs.
IMPORTANT: We hash a sanitized projection of config. Do not include secrets.
This is local-only; whether you transmit drift events off-device is controlled by the host app.