Bundle drift detection and correction (#2101)

Gemfile.saas evals Gemfile, so shared gems should have identical versions
in both lockfiles. This adds bin/bundle-drift to detect and fix drift:

* `bin/bundle-drift check` compares shared gem versions
* `bin/bundle-drift correct` seeds Gemfile.lock from Gemfile.saas.lock
  and re-locks, letting Bundler prune SaaS-only gems while preserving
  shared versions

Adds drift check to bin/ci and GitHub CI. Corrects existing drift.

.github/workflows/ci-checks.yml

@@ -7,6 +7,20 @@ permissions:
   contents: read
 
 jobs:
+  gemfile-drift:
+    name: Gemfile drift
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: .ruby-version
+          bundler-cache: true
+
+      - name: Check for lockfile drift
+        run: bin/bundle-drift check
+
   security:
     name: Security
     runs-on: ubuntu-latest