Verify Knock production registry matches knock/workflows/*.json

Post-mortem follow-up from 2026-06-01 LEARNINGS: PR #295 added --yes (nonexistent flag) instead of --force to `knock commit promote`. 4 days of silent production-registry drift between 2026-05-29 20:36 UTC and 2026-06-01 14:09 UTC. PR #302 fixed the CLI flag, but we should verify the production state actually matches the repo state. Check command (requires KNOCK_API_KEY in env): ``` cd ~/agents/meridian/commongrid ls knock/workflows/*.json | xargs -I {} basename {} .json | sort > /tmp/repo.txt knock workflow list --environment production --output json | jq -r .[].key | sort > /tmp/prod.txt diff /tmp/repo.txt /tmp/prod.txt ``` Expected output: empty diff. If non-empty, fix the drift (either push missing workflows via CI by retriggering, or open PR to add missing repo entries if prod has extra workflows not in IaC). If knock CLI is not available locally, the equivalent check via the Knock REST API is `curl -H Authorization: Bearer $KNOCK_API_KEY https://api.knock.app/v1/workflows?environment=production`.