Compare complete workflow policy selectors before declaring them in sync #539

🤖 Generated by the Agentic Engineer

The workflow execution policy comparison currently drops repository-property source and repository-name protection when normalizing selectors. Different valid selectors can therefore compare equal. This prevents the drift check from proving that GitHub stored the reviewed targeting policy.

Preserve every supported selector parameter, including the API's default property source, and reject malformed or unsupported selector fields before any write. Keep ordering and documented server metadata from causing false drift.

Acceptance:

• Behavioral fixtures distinguish custom from system properties and repository-name protection, including omitted defaults.
• Invalid selector values or unknown targeting fields fail validation; an unreadable or malformed live selector stops the complete reconciliation before any write.
• Update/readback fixtures cannot report success when selector semantics differ.
• Existing policy tests, repository validation, exact-head CI and substantive review pass; the fix merges and the reviewed main reconciler completes with its existing policy set.

Part of #202. This repair does not activate or broaden any declared policy.