feat: gate the committed config reference against drift

docs/changes/setup-ux/tasks.md

@@ -13,14 +13,14 @@
 - [x] 2.2 Add `rune provider status` with the six lifecycle states
 - [x] 2.3 Add `rune provider explain` with evidence, state, and fix command
 - [x] 2.4 Move setup, context, status, doctor, and drift to the shared registry
-- [ ] 2.5 Add the config-reference drift check to CI
+- [x] 2.5 Add the config-reference drift check to CI
 
 ## 3. Safe mutation and onboarding
 
 - [ ] 3.1 Add the syntax-preserving config editor with the managed override fallback
 - [x] 3.2 Add scoped `rune config reset` with backup, verification, and atomic write
 - [ ] 3.3 Protect modified installed skills from silent replacement
-- [ ] 3.4 Extend `rune setup` with plan, approval, apply, verification, and the versioned record
+- [x] 3.4 Extend `rune setup` with plan, approval, apply, verification, and the versioned record
 - [x] 3.5 Add the first-run nudge in the dispatch path, independent of the `tui` feature
 
 ## 4. Verification