When a pinned lane drifts, the script prints actual/expected SHAs but
gives no guidance. Authors then have to look up that --update exists
and that CLAIMS.md needs regenerating alongside.
Adds a remediation block printed only on mismatch, listing the most
common drift sources (core/cognition/result.py, chat/runtime.py,
generate/realizer.py, capability registries) and the two commands
needed to re-pin: --update + generate_claims.py.
Why this is the right scope: branch protection now blocks merge on
red lane-shas CI (enabled 2026-05-24), so the remaining gap is
discoverability — telling authors what to do, not enforcing that
they do it. A one-line message change carries that signal without
adding hooks, templates, or infrastructure.
No behavior change on success.
c7c21e6acf