Summary

• add an opt-in slot config-drift payload by comparing live container argv with the freshly rendered restart argv
• surface drift through slot status, API serialization, and CLI status output without adding shell-outs to the slot list poll path
• harden drift comparison by pinning renderer flag spellings and treating --model symlink/realpath spellings as the same file

Verification

• uv run --extra dev ruff check src/hal0/slots/manager.py tests/providers/test_container.py tests/slots/test_manager.py
• uv run --extra dev pytest tests/api/test_slots_routes.py tests/cli/test_slot_status.py tests/providers/test_container.py tests/slot_view/test_aggregator.py tests/slots/test_manager.py -q (206 passed, 1 Starlette/httpx deprecation warning)

Notes

• Singleton container_provider access remains intentional house style in SlotManager; a broader injection refactor should handle all call sites together.
• CT105 deploy smoke still needs to confirm an untouched slot reports no drift in the real runtime environment.