feat(apply): apply-time safety gates — declared-resource existence + drift preview/verify

feat(apply): apply-time safety gates — declared-resource existence + drift preview/verify #166