Phase 2: drift detection

Compares cloud_provisioned.spec (what we asked DO for) against the live
cloud_resources row (what DO actually has). Any divergence becomes an
operator-resolvable drift record.

cloud_drift table: one row per drifted field. status open/accepted/
reverted/stale. Partial unique index keeps at most one OPEN drift per
(resource, field); resolved rows are retained as history.

ArcadiaCloud.Drift context:
- detect_all/0 — sweeps every provisioned resource. Per field in spec,
  resolves the actual value (top-level schema field first, then attrs),
  compares with loose equality (stringified scalars; lists as sets so
  JSON round-trips don't false-positive). Mismatches upsert a cloud_drift
  row + emit a drift_detected event in the resource event log.
- close_stale_drift — an open drift whose field no longer mismatches
  (fixed elsewhere) closes as "stale" on the next sweep.
- accept_drift/2 — the live value becomes the new desired-state: parent
  cloud_provisioned.spec is updated, spec_version bumped, drift closed
  "accepted". Revert (mutating live infra back to spec) is intentionally
  NOT here — it needs a saga and lands with the droplet-resize work.

DriftDetectionWorker — Oban cron at :20 past the hour, offset past the
:15 resource syncs so it compares against fresh inventory.

Provisioning.record_provisioned/3 — populates cloud_provisioned desired-
state (upsert on resource_id, bumps spec_version). Future provisioning
sagas call this; for now it's how drift gets something to detect.

API (platform_admin only):
- GET  /api/v1/drift            — open drift inbox
- POST /api/v1/drift/:id/accept — adopt live value as desired-state

Smoke verified: recorded a droplet's desired spec with a deliberately
wrong size_slug + a correct region; detect_all flagged only size_slug,
wrote the drift_detected event; accept updated the spec to the live
value and closed the drift; re-detect found zero drift.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lib/arcadia_cloud/provisioning.ex

@@ -56,6 +56,41 @@ defmodule ArcadiaCloud.Provisioning do
     |> Repo.insert()
   end
 
+  alias ArcadiaCloud.Provisioning.CloudProvisioned
+
+  @doc """
+  Records desired-state for a resource we provisioned. `spec` is a flat
+  map of field => expected value that drift detection later compares
+  against the live resource. Upserts on resource_id.
+  """
+  def record_provisioned(resource_id, spec, opts \\ []) do
+    now = DateTime.utc_now() |> DateTime.truncate(:second)
+
+    attrs = %{
+      resource_id: resource_id,
+      spec: spec,
+      provisioned_at: now,
+      provisioned_by: opts[:provisioned_by] || "system",
+      saga_id: opts[:saga_id]
+    }
+
+    case Repo.get_by(CloudProvisioned, resource_id: resource_id) do
+      nil ->
+        %CloudProvisioned{}
+        |> CloudProvisioned.changeset(attrs)
+        |> Repo.insert()
+
+      existing ->
+        existing
+        |> CloudProvisioned.changeset(Map.put(attrs, :spec_version, existing.spec_version + 1))
+        |> Repo.update()
+    end
+  end
+
+  def get_provisioned(resource_id) do
+    Repo.get_by(CloudProvisioned, resource_id: resource_id)
+  end
+
   @doc """
   Starts a snapshot saga for a droplet. `droplet_provider_id` is the DO
   numeric droplet id (string). Optional `:snapshot_label` and