Function verify 

pub fn verify(
    approved: &ReleasePlan,
    contract: &Contract,
    facts: &Facts,
    head_sha: &str,
) -> Result<(), PlanDrift>

Check whether an approved plan still matches the current repo state.

The coordinator calls this before crossing into any irreversible phase of release cut --plan <plan_id>. It re-derives the current plan_id from the current contract, facts, and head_sha, holding the chosen version fixed to the approved plan’s (a cut may not change the sealed version — that would require a new plan). Ok(()) means the approval is still valid; a PlanDrift carries the mismatched id pair and human-readable reasons for the plan_stale error envelope. The plan_id mismatch is authoritative; the reasons are best-effort and may be non-exhaustive — the approved plan intentionally does not retain the old normalized contract (trust the journal, not a re-supplied contract), so an exact field-level contract diff is not possible here. When more than one input drifts, the reasons name every one they can pinpoint (HEAD, schema version, target set) and fall back to a generic contract-changed note only when none of those explain it.

Errors

Returns PlanDrift when the recomputed plan_id differs from approved.plan_id — i.e. the repo moved (a commit, a manifest rename, a schema bump, a target-set change, or any normalized-contract change) since approval.