ci: catch drift in the restated orchestrator commands

[rickstaa]

Closes #51, taking the CI-guard option.

api-proxy and vllm restate all sixteen orchestrator flags because static runners need -liveRunnerConfig and extends replaces a command list rather than appending to it. This checks those copies still match the shared file, and allows only that one flag to differ.

It catches the case from the issue

Reproducing the #50 regression, where both copies kept -ticketEV=1e9 after the shared file moved to 1e10:

$ python3 scripts/check_orchestrator_drift.py
orchestrator command drift:

  vllm/compose.onchain.yml: -ticketEV is '-ticketEV=1000000000', compose.onchain.yml has '-ticketEV=10000000000'

These examples restate the shared command because they add ['-liveRunnerConfig'] and
`extends` cannot append to a list. Re-copy the shared command, or widen ALLOWED_EXTRA
if the new flag is deliberate.

Also catches a flag deleted from a copy, and a flag added to a copy that is not in the allow-list.

Both sides, not just on-chain

The issue is about compose.onchain.yml, but the same duplication exists offchain: api-proxy/compose.yml and vllm/compose.yml restate compose.orchestrator.yml's command too. The check covers both, four restated copies in total today.

How it runs

A local pre-commit hook, so the existing lint job picks it up with no workflow change. pass_filenames: false because it always needs the shared file, with a files: pattern so it only fires when a compose file is touched.

It reads the tracked file list via git ls-files, so a work-in-progress example directory that is not committed yet will not fail anyone's local run.

Note on widening

When a genuinely new flag is needed by the static runners, add it to ALLOWED_EXTRA in the script. That makes the exception explicit and reviewable rather than silent.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.