keystone:verify — cascade + drift check

Check vendored policies for drift and the strict cascade for project-layer violations.