feat(choudoufu): attribute drift from the plan, opt-in on refresh — a second mark on a bound card, the attributes in the diff pane (#404)

[lex00]

Closes #404. Stacked on #405 (the behaviour overlay), which is stacked on #395 and #392.

A bound choudoufu card stayed green while choudoufu plan showed an attribute change, because the overlay is composed from live-ls and live-plan, which answer ownership and never read a value. This adds the attribute half, opt-in.

What changed

• Source. choudoufu plan -json on 0.16.0 is choudoufu's own ownership document, not OpenTofu's change stream, and carries no attribute values — measured, not assumed. So the read is plan -input=false -out=<tmp> then show -json <tmp> (format 1.2, resource_changes[].change.{actions,before,after}), the plan file under a mkdtemp in the OS temp dir and removed in a finally, never inside the served member. Argv pinned in src/choudoufu-plan.ts.
• Opt-in. ?plan=1 on /api/overlay and /api/diff, sent by a second palette row, "Re-check live with plan (attribute drift)". Not the existing refresh: plan is one provider read per resource (301 on terralith-4), and POST /api/refresh is a primary-only re-observe that never composes the estate, so it is both the cheap button and the wrong request. Cached under the member's source stamp, so a reload after a refresh does not re-plan. Never on the initial read.
• Paint. Ownership stays the card's colour. A bound resource with a non-empty change set gets a dashed mark and a ~ 2 attributes glyph; the names are in the tooltip and the inspect pane, where diff.changes renders before → after through the existing pairCell path with one new label word, planned. Sensitive values read (sensitive), unknowns (known after apply). The legend and statusbar say n drifted only when the plan was read; meta.drift is { read: false } or { read: true, drifted: n } so the SPA can tell "not looked" from "none". A planned create on an unowned resource is not drift.
• Fixture. Three plan documents recorded against the iam-ecr cohort on floci: clean, drift (a tags change on the role with both markers identical on each side, which is exactly why the ownership half never noticed, and image_tag_mutability IMMUTABLE → MUTABLE on the repository), and a create.
• Docs. AGENTS.md, the README's choudoufu paragraph and the demo's description now say a green card is ownership, not "nothing changed", and where the attribute read is.

Verified live

On the iam-ecr cohort against floci: green with no drift clause; one out-of-band change; ?plan=1 marks the card while it stays bound and green, /api/diff names the attributes with before → after, the legend reads 2 drifted; a reload without the flag serves the cache; the attribute restored, the drift is gone. Both gates green; no scratch container left.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DoXg2GDWwXJRPQo76t9Nrq