Complete drift detection and remediation pipeline via GitHub Agentic Workflow

## Description

The manifesto states: "Agents detect drift, propose fixes, generate plans, request approval, and apply remediations." The `azure-drift-detector` skill exists but is incomplete — missing scripts, no workflow, no auto-remediation. Rather than a traditional scheduled GitHub Actions workflow, this should be implemented as a **GitHub Agentic Workflow** (`gh-aw`) — a scheduled agent that runs periodically, inspects deployments, compares state, and opens PRs to resolve drift.

Related: #12 (GitHub Agentic Workflows adoption)

## Implementation Approach: `gh-aw` Agentic Workflow

The drift detection workflow is authored as a Markdown file (`.github/workflows/drift-detection.md`) and compiled via `gh aw compile` into a hardened GitHub Actions workflow. The agent:

1. Runs on a schedule (e.g., daily or weekly via `cron`).
2. Iterates over all tracked deployments in `.azure/deployments/`.
3. For each deployment with `state.json` status `succeeded`, queries live Azure resource state via `az` CLI.
4. Compares live state against the stored `template.json` + `state.json`.
5. If drift is detected:
- Creates a branch with an updated drift report.
- Updates the template or state to reconcile (depending on drift category).
- Opens a PR with the drift findings, categorized by severity.
- PR includes: what changed, why it likely changed (policy remediation, manual edit, platform update), and proposed fix.
6. If no drift: logs clean status.

## Scope

1. **Complete `azure-drift-detector` skill** — Replace missing `detect-drift.sh` with `az` CLI commands in the skill procedure. Ensure it can be invoked by both the interactive agent and the agentic workflow.
2. **`drift-detection.md` agentic workflow** — Author the gh-aw Markdown workflow with schedule trigger, Azure OIDC login, and drift detection logic. Compile to `.github/workflows/` via `gh aw compile`.
3. **Drift categorization** — Categorize drift by likely cause: (a) manual Portal change, (b) Azure Policy remediation, (c) platform update, (d) unknown.
4. **PR-based remediation** — Drift resolution is always via PR: agent proposes template or state update, human reviews and merges.
5. **`@git-ape drift` interactive command** — For on-demand drift checks in VS Code chat.

## Acceptance Criteria

- [ ] `drift-detection.md` agentic workflow authored and compiles via `gh aw compile`.
- [ ] Workflow runs on schedule, iterates deployments, detects drift.
- [ ] Drift findings opened as PRs with categorized changes.
- [ ] `@git-ape drift ` works interactively.
- [ ] Drift report categorizes changes by severity and likely cause.
- [ ] `azure-drift-detector` skill is functional (no missing scripts).