phase2-attest-baseline: drift-aware --baseline diff for azureclaw attest (Phase 2 S11.1)

[Pal Lakatos-Toth (pallakatos)]

Outcome-shaped follow-up to S11 (#59). Turns azureclaw attest from "print JSON" into a CI-gate / change-control primitive.

Real-world workflow this unlocks

# Day 0 — capture approved posture
$ azureclaw attest demo --format json > approved.json
$ git add approved.json && git commit -m "approved: demo posture"

# Every PR / nightly job — fail the build on drift
$ azureclaw attest demo --baseline approved.json || exit $?
✗ ToolPolicy 'tp-prod' versionHash drifted (sha256:abc1234… → sha256:def5678…)
✗ new SSA manager touched the object: 'kubectl-edit'
DRIFT: 2 delta(s) — exit code 2

Surface

• cli/src/commands/attest.ts adds diffAttestations (pure function), loadBaseline, describeDelta, --baseline flag, exit-code handling.
• cli/src/commands/attest.test.ts adds 11 new cases (every delta variant, set-vs-count invariant, missing/invalid baseline, exhaustive describeDelta).
• CHANGELOG.md — S11.1 entry above S11.
• docs/security-audits/2026-04-28-phase2-attest-baseline.md — 11-section audit (reuse, STRIDE, out-of-scope, set-vs-count rationale).

Deltas surfaced (one variant per human-meaningful change)

Variant	Trigger
specHash	ClawSandbox.spec itself changed
phase	Running ↔ Overlay ↔ Degraded
policyVersionHash	Referenced policy CR was recompiled
policyAdded / policyRemoved	Spec references a different policy set
fieldOwnerAdded / fieldOwnerRemoved	New/removed SSA manager

Set-comparison, not count-comparison, on field owners. SSA bumps the per-field count on every controller reconcile (noisy); set comparison is the right granularity to flag "did a new actor touch this object?" without paging on every reconcile. Asserted in tests.

Exit codes (CI-friendly)

• 0 — match
• 2 — drift (deltas reported in human + JSON output)
• 3 — baseline file missing (stderr before any kubectl)

Pure-function design

diffAttestations(baseline, current) has no IO, no time, no kubectl. A future Phase 3 azureclaw verify <bundle> companion can reuse it unchanged.

Reuse, no duplication (§0.2 #11)

• Diff inputs are the S11 AttestationReport shape; baseline file is the S11 attestation JSON envelope. No second schema.
• No new dependency (node:fs/promises already in CLI).
• No CRD change, no controller change, no new K8s object.

Out of scope (Phase 3)

• Signed-baseline verification (lands when controller emits cosign signatures).
• azureclaw verify <bundle> companion (will reuse diffAttestations).
• --at <ts> time-travel mode (needs controller-side persistent receipt log).
• --all / --baseline-dir fleet mode (separate slice).

Verification

• cd cli && npx tsc --noEmit ✅
• cd cli && npm test — 315 passed | 2 skipped (was 304+2; +11 from this slice) ✅
• cd cli && npm run lint ✅ (preexisting warnings only)
• BASE_REF=origin/dev bash ci/no-stubs.sh ✅
• BASE_REF=origin/dev bash ci/no-custom-crypto.sh ✅
• BASE_REF=origin/dev bash ci/check-loc.sh ✅

Phase 2 progress on dev after merge: ✅ S1 #51, S2 #52, S3 #53, S4 #54, S5 #55, S6 #56, S8 #57, S11 #59, S11.1 (this PR) — 9 of ~14 slices.