Policy drift alert

This is the identical condition R9 checks, but computed directly against the domain's live current_published_policy vs approved_baseline_policy rather than depending on the recommendation engine having already run — so the daily alerting digest keeps working standalone even if bin/analyze.php hasn't executed.