Harden durable Yieldstar reconciliation

[djgrant]

Stacked on #36. Review pass over the durable Yieldstar 0.5.0 integration, verified against the installed 0.5.0 runtime sources.

Fixes

• Emits reconciler.drift.detected as a durable step before a drift-update decision, restoring event parity with the synchronous reconciler.
• Emits a durable update skip lifecycle event (update-not-implemented) when a resource has no update operation, instead of silently returning.
• Removes an unreachable dryRun check after the provider mutation.
• YieldstarStateBackend now reads a store snapshot in one round trip and treats a store deleted mid-read as resource absence, instead of calling listStores before every get, update, and delete.
• YieldstarStateBackend.update returns the committed store version from updateStoreFrom rather than a locally computed revision.

Tests

• Orphan deletion through the resource registry on the durable path (previously untested): a resource removed from the desired set has its provider delete called once and its store removed.
• Drift repair: a drifted remote read produces one reconciler.drift.detected event with the patch diff, one drift-update decision, and one provider update call.

Docs

• Documents that a deployment which crashed while holding the coordination store is resumed by re-running the same execution ID, which reclaims the acquisition through the applied-step ledger and releases it on completion.

Verified as sound

• Store identity: conditional workflow update and delete go through updateFrom/deleteFrom with the snapshot's UUIDv7 instanceId and version, with stepId supplied by the workflow store handle for exactly-once replay.
• Crash replay: provider calls, state reads, and emits are keyed durable steps; the crash-resume and durable-wait tests exercise the heap replay path.
• No compatibility fallbacks: reconcileWithYieldstar does not use leases or the synchronous step runner; the synchronous Reconciler remains only as the documented CLI path for this release slice.

Remaining for a later loop

• CLI deploy/destroy still run the synchronous Reconciler; moving them onto the resident workflow runtime is the next stacked phase per the RFC.
• Durable destroy is not yet a first-class workflow operation.
• docs/manual/reconciler.md fails prettier --check because prettier rewraps markdown mid-sentence, which project docs style forbids; pre-existing on the parent branch.

Checks run: pnpm build (13/13), pnpm typecheck (11/11), pnpm test:once (109 passed, 4 skipped).

[djgrant]

Closing this review-only PR. Its fixes are included in build PR #38, which is now stacked directly on #36.