feat(ci): structural drift gate for cascade list vs manifest (RFC #388 PR-3)

[HongmingWang-Rabbit]

Summary

Closes the recurrence path of PR #2556. The data fix realigned 8→4 templates in publish-runtime.yml's TEMPLATES variable, but the underlying drift hazard was unguarded — the next manifest change could silently leave cascade out of sync again.

What it gates

Any PR that changes `manifest.json` or `publish-runtime.yml` in a way that makes the cascade list diverge from manifest `workspace_templates` (suffix-stripped). Either direction is caught:

Mode	Bug class
Templates in manifest but missing from cascade	The codex-stuck-on-stale-runtime class. PR #2512 added codex to manifest; cascade wasn't updated; codex stayed pinned to its last-built runtime version for weeks until PR #2556.
Templates in cascade but not in manifest	Wasted-API-calls + dead-CI-noise class. PR #2536 pruned 5 templates from manifest; cascade kept dispatching to all 8 until PR #2556.

Implementation

`scripts/check-cascade-list-vs-manifest.sh` — bash, jq, single grep+sed+comm pipeline (~50 lines). Triggers narrowly: only on PRs that touch `manifest.json`, `publish-runtime.yml`, or the script itself.

Self-tested both failure modes locally before commit

Drop `codex` from cascade → script fails with `MISSING: codex`.
Add `langgraph` to cascade → script fails with `EXTRA: langgraph`.
Current staging cascade aligned with manifest → script passes (4 entries).

A subtle bug I caught while writing this

First draft used `\s*` in the sed pattern. macOS BSD sed doesn't recognize `\s` — treats it as literal `s` with `*` quantifier (matching empty-prefix-of-literal-s). The pattern "matched" but didn't strip the leading whitespace, so the captured group was ` TEMPLATES="claude-code hermes openclaw codex"`, which then split into garbage tokens.

Fixed to `[[:space:]]` which works on both BSD and GNU sed. Documented inline so the next person adding a similar script doesn't re-stumble.

Refs

• RFC: #388
• Source-of-truth alignment fix (companion): PR #2556
• Strategic prune that started this drift class: PR #2536

Test plan

• YAML validates
• shellcheck passes (only style nits remaining: SC2001 sed-vs-bash-param-expansion, kept for clarity)
• Both failure modes verified locally (missing codex, extra langgraph)
• Current staging passes
• CI green on this branch
• After merge: any future drift surfaces immediately as a CI failure on the PR that introduced it

🤖 Generated with Claude Code