Draft: Add the settings policy drift check and reconciliation workers

What does this MR do and why?

Adds the background half of settings enforcement, calling the evaluation service of https://gitlab.com/gitlab-org/gitlab/-/work_items/630148:

• Govern::PolicyEngine::ScheduleWorker runs daily. It collects the candidate projects of every active settings policy through the resolver of !259956 (merged), then evaluates each project once, with every policy scoped to it acting on that one snapshot. Evaluations record the engine-internal project_settings_drift_checked trigger, which authors cannot pick.
• Govern::PolicyEngine::ProjectReconciliationWorker subscribes to the project created and project transferred events, so a new or arriving project gets evaluated right away.
• A new or changed settings policy enqueues a targeted ScheduleWorker run for itself, so it takes effect without waiting for the next daily tick. The policy model gains IMPACT_RELEVANT_COLUMNS to decide which saves count.

Both workers only observe and record for now. Writing the demanded value back is the executor of https://gitlab.com/gitlab-org/gitlab/-/work_items/630155.

The code comes from the prototype in !259574, now with specs. No changelog entry, because security_policies_v2 defaults to off.

Merge plan (nested = depends on parent, siblings = parallel)

• !261560 (merged) evaluation service
  • !261838 settings fence
  • !261561 drift workers (this MR)
  • !261562 conflict check
    • !261837 set_setting write-back
      • !264545 cross-trigger E2E (also needs fence, drift workers)
• !262405 effective archived state

References

• Issue: https://gitlab.com/gitlab-org/gitlab/-/work_items/630154
• Epic: https://gitlab.com/groups/gitlab-org/-/work_items/23462

Screenshots or screen recordings

Backend-only change, no UI.

Before	After

How to set up and validate locally

1. Enable the experiment and point the engine at a running Policy Store, as in the evaluation service MR.

2. Create a settings policy with the project_created trigger, then create a project in its scope. Govern::PolicyEvaluation gains a project_created row for it.

3. Run the daily check by hand and inspect the recorded evaluations:

   Govern::PolicyEngine::ScheduleWorker.new.perform
   Govern::PolicyEvaluation.trigger_type_project_settings_drift_checked.last

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.