No way to reconcile a live instance with a changed resource definition

Root cause of #93's blast radius. newgit-trial was spawned when supabase declared four ports. I then added inbucket and analytics to the definition. The live instance's record still claimed four while its containers held six, so the allocator's ledger was silently incomplete — and nothing anywhere said so.

The only recovery was newgit remove newgit-trial, i.e. destroy the instance. For a branch with real work in it that is a bad trade.

Expected: at minimum, a warning wherever the graph is already validated (resource list, and at spawn):

instance `newgit-trial` predates the current definition of `supabase`:
  ports `inbucket`, `analytics` are declared now but absent from its binding record

Better: a newgit rebind <instance> that allocates newly-declared ports and re-renders, so a definition fix doesn't cost the instance. This cannot move existing ports — allocation is for life, correctly — it only needs to fill gaps.

Related: #38 established that status should say when an instance's base has moved. This is the same idea for definitions rather than source.

Environment: newgit 0.3.0 (fba8fa7090e2), macOS 15 (Darwin 25.6.0), APFS. npm-workspaces monorepo (Expo/React Native + Next.js + Supabase); local stack is Supabase CLI 2.107.0 (12 containers, Docker Desktop 28.2.2), Metro, and a Dockerised routing service. 4 instances spawned over one session; resources deps (install), expo (process), supabase (command-snapshot-migrations), r5 (project-owned).

Start with the validation paths used by resource list and spawn, then trace how the instance binding record is compared with the current resource definition and allocator ledger. Done means detecting newly declared ports absent from an existing instance and reporting the instance, resource, and missing ports; assess whether the proposed rebind <instance> behavior fits the same lifecycle.