feat: detect orphaned generated workflows in cascade verify

[joshua-temple]

Problem

cascade verify reported drift only for missing or changed planned files. A cascade-owned workflow left behind after a manifest change (for example, removing an environment or build) stayed on disk undetected, so committed workflows could carry stale generated files that the manifest no longer plans.

Fix

verify now scans the workflows output directory for cascade-owned files that are not in the current plan and reports them as orphans. Detection is keyed off the cascade-generated marker, so hand-written workflows in the same directory are never flagged. Orphans are reported distinctly (? <path> (orphaned)) and return the existing drift exit code (1); the 0/1/2 exit contract is unchanged. A new --allow-orphans flag opts out. The scan is read-only and confined to the workflows output directory. The generated-file marker is now a single exported constant (generate.GeneratedFileMarker) that all writers and verify share.

Verification

• go build ./cmd/... ./internal/..., go test ./... (1517 pass), golangci-lint run ./... (clean)
• e2e module builds and vets clean; new scenario 27-verify-orphan.yaml parses and validates
• New unit tests cover clean repo, orphan drift + exit 1, --allow-orphans opt-out, hand-written files never flagged, and sorted/deterministic output

Closes #230