feat: add drift reconciliation (self-healing stacks)

[hoegertn]

Extend the scheduled drift-detection workflow with an optional remediation
phase that reverts drifted CloudFormation stacks back to their deployed
template using a REVERT_DRIFT change-set. This is CloudFormation-only: it
operates on the live stack and its deployed template, with no CDK synth.

New public API (src/drift/base.ts):

• RemediationPolicy ('off' | 'manual' | 'auto')
• DriftRemediationOptions (include/exclude resource-type globs)
• defaultRemediation workflow option and per-stage remediation override
• resolveRemediation() helper and DEFAULT_EXCLUDE_RESOURCE_TYPES

New CLI (src/drift/revert-drift.ts, registered as the revert-drift bin):

• classifyDrift() splits drift into revertable / excluded / deletion buckets
  with glob-based include/exclude filtering
• DriftReverter runs create-change-set --use-previous-template +
  execute-change-set --deployment-mode REVERT_DRIFT

New steps (src/drift/step.ts): DriftRemediationStep, DriftVerificationStep.

Per-engine wiring (all strictly gated on policy != 'off'):

• GitHub: remediate job (with a deployment-environment gate for manual)
  and a verify job after remediation
• GitLab: remediation + verify stages, when: manual / when: on_success
  by policy, dotenv propagation for stage credentials
• Bash: run_remediation_<stage> / run_verify_<stage> functions, a --yes
  flag, and an interactive confirmation for manual

Safety defaults: off by default (zero behavior change on upgrade — all 119
existing snapshots pass unchanged); sensitive resources
(AWS::RDS::*, AWS::DynamoDB::Table) are excluded by default; deletion drift
is reported but never reverted; drift in an excluded type blocks automatic
reversion. Adds 11 tests (classification, policy resolution, and per-engine
remediation snapshots); 210 tests pass, jsii compiles clean.