test(e2e): assert the drift-comment workflow emits empty permissions

[joshua-temple]

What is not yet asserted

Scenario 28 round-trips the generated drift-check files through cascade verify, but it never asserts the least-privilege permissions: {} block the drift-comment companion is supposed to emit. The security posture of that companion workflow is generated but unchecked.

Features closed (2)

wf.drift.empty-permissions, sec.empty-permissions-default

Closing approach

Layer: act+gitea. Extend the drift-check scenario with a workflow_files.contains assertion pinning the permissions: {} (and the top-level contents: read) block on the emitted drift-comment workflow, mirroring the pattern already used in orchestrate/least-privilege-permissions.yaml.

Acceptance

• A workflow_files.contains assertion on the drift-comment permissions: {} block.
• Scenario green.

[joshua-temple]

Closed by #370: e2e scenario 28-drift-check now asserts the generated drift-comment workflow carries permissions {} (least privilege), and the drift-comment permissions block is also unit-asserted in internal/generate/drift_check_test.go.