Registry credential drift is invisible to `cluster diff` and to non-Updater provisioners

> 🤖 Generated by the Agentic Engineer

## Evidence

Found while fixing #6480, which was the same defect one check over. `checkRegistryCredentialDrift`
is wired into the Updater diff path only:

| Path | `checkWorkloadTagDrift` | `checkFluxDistributionVersionDrift` | `checkFluxVerifyDrift` | `checkRegistryCredentialDrift` |
|---|---|---|---|---|
| Updater path (`orchestrator.go` ~927–937) | ✅ | ✅ | ✅ 937 | ✅ **933** |
| `computeSpecOnlyDiff` (~1021+) | ✅ | ✅ | ✅ *(after #6480)* | ❌ **absent** |

Verified on `main` at the time of filing: `checkRegistryCredentialDrift` has exactly one call site,
`orchestrator.go:933`, inside the Updater path. Once #6480 lands, this is the **only** drift check
still missing from `computeSpecOnlyDiff`, which is what makes it read as an oversight rather than
deliberate scoping.

`computeSpecOnlyDiff` is reachable from two production call sites — `handleDiffRunE` (the
user-facing `ksail cluster diff`) and `runWithoutUpdater` (provisioners with no `Updater`, e.g.
VCluster).

## Affected audience and impact

1. **Anyone previewing an update.** A rotated registry token behind an unchanged spec does not show
up in `cluster diff`, so the plan and the apply disagree — the same trusted-preview problem
#6480 fixes for verification.
2. **Non-Updater provisioners.** Credential drift is never detected on those clusters at all, so a
rotated token is only discovered when an image pull fails.

## Expected behaviour

`checkRegistryCredentialDrift` runs in `computeSpecOnlyDiff` too, so `cluster diff` previews the
same credential repair `cluster update` would apply.

## Acceptance criteria

- [ ] `computeSpecOnlyDiff` invokes `checkRegistryCredentialDrift` alongside the other drift checks.
- [ ] A test pins that credential drift surfaces through the `cluster diff` path, failing before the
wiring and passing after.
- [ ] The check’s existing guards still suppress it where it must stay silent (no cluster query
spent when there is nothing to compare).

## Size

Small — one call plus a test, mirroring #6480.

Start in orchestrator.go at computeSpecOnlyDiff and compare its existing drift checks with the Updater path around lines 927–937; trace its callers handleDiffRunE and runWithoutUpdater. Add coverage showing registry credential drift through the cluster diff path, while preserving the check’s existing guards and confirming the relevant Go tests pass.

Written by the indexing model from the issue text.