Detect drift in the four declared organization settings #403

🤖 Generated by the Agentic Engineer

Problem and evidence

The four organization-wide settings tracked by #85 remain outside the provider's settings schema. A fresh read confirms the expected values are still present, but there is no maintained drift check for this gap. Repository reconciliation cannot detect an organization setting changing.

Smallest useful delivery

Declare the four expected settings in a separate audit policy, compare a complete typed live organization response, and expose a manual, default-off read-only workflow. A mismatch fails; incomplete or malformed evidence is UNKNOWN. No organization settings are changed.

Acceptance

• Strictly bind the organization and all four setting names and value types.
• Reject failed or partial reads even when plausible JSON was printed first; distinguish drift from UNKNOWN.
• Exercise clean, each changed setting, missing fields, malformed input, wrong organization and failed-read controls.
• Use only read authority, reviewed main source and explicit opt-in; the false control performs no credential step.
• Demonstrate the actual comparison locally and through the merged native workflow before marking delivery complete.

Parent: #85. Size: S. Provider-based settings adoption remains a separate gate.