Add Donmai drift assessment to pull requests

[MarkKropf]

Adds a pull-request drift check for changes targeting main. It invokes the published Donmai Action at a full commit SHA, uses the default no-severity-high policy with automatic comments, limits token permissions to repository read and pull-request write, and cancels superseded runs. The Action reads the diff without checking out or executing pull-request code.

The workflow is configured to run on this pull request so its own outside-repository check and comment behavior can be observed. No application code or sample data was changed.

Local verification passed: actionlint, swift build, and swift test --parallel (79 tests).

[github-actions]

Donmai native drift check

Commit: 87cea3b813e43c928e78b12d863537ffc01215cf
Policy: no-severity-high

Policy passed.
Native observations: 0 (patterns: 0, conventions: 0, decisions: 0).

This is regex-based diff analysis, not a learned architectural baseline or a semantic review.
Analyzer: Donmai 0.72.47. A passed policy does not mean there are no architectural problems.