Drift

Tenants whose applied template release is behind the catalog HEAD for their folder version. Pinned tenants (templatesRef = sha) appear separately so intentional drift stays auditable.