fix(config): make catalog drift policy configurable

[noah-ing]

What

Allow the existing catalog.drift_policy setting through strict configuration validation, reject unknown keys inside the catalog block, and document both supported policies.

Why

This is a narrow follow-up to #523 and #58. The parser already consumed catalog.drift_policy and the proxy already enforced it, but _KNOWN_TOP_KEYS omitted catalog. Every explicit catalog: block was therefore rejected before the parser ran; the default fail_closed behavior worked only because it required no block.

This reconnects the existing configuration contract without changing drift detection, comparison, or the default policy.

Security impact

None. This does not touch the TEE boundary, signing path, audit chain, capability tokens, or trust-score inputs. fail_closed remains the default, warn_only remains an explicit operator choice, and unknown nested keys are rejected so misspellings cannot silently fall back.

Test plan

• pytest passes — 1,179 passed, 6 skipped
• ruff check passes
• mypy passes — 63 source files
• Manual test performed
• bandit -r src/ -c pyproject.toml passes
• mkdocs build --strict passes

Manual test: on the parent commit, loading YAML with catalog.drift_policy: warn_only raises ConfigError: Unknown config key 'catalog'. With this change, it loads as DriftPolicy.WARN_ONLY. The suite also covers the omitted default, invalid enum, non-mapping block, and unknown nested key.

DCO sign-off

• I certify that I wrote or have the right to submit this contribution, and I agree to the Developer Certificate of Origin (https://developercertificate.org).

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[imran-siddique]

Verified the dead-code path this reconnects. load_config already did raw.get("catalog", {}) and built a DriftPolicy from it, but _KNOWN_TOP_KEYS omitted catalog, so strict validation rejected the block before the parser ever reached that line. The default worked only because it required no block at all, which means every operator who wrote an explicit catalog: stanza got a config error for a setting the proxy was already enforcing.

The unknown-nested-key guard is the part worth having. test_unknown_catalog_key_raises pins the misspelling case, so drift_polciy: warn_only is a config error rather than a silent fall back to fail_closed while the operator believes they set warn_only. That matches what agent_manifest and kill_switch already do, so the block reads like the rest of the file.

Default unchanged, no change to drift detection or comparison, nothing near the signing or attestation path. Merging.