Six differences exist by design and are now recorded in DEVIATIONS with the reason
each one was forced, so the check passes on today's tree and fails on tomorrow's
accident: the four `*-init` Django services folded into their web pods (one migrator
per database), and the two bootstrap Jobs compose runs from the host instead.
Verified against both drift classes by hand: bumping OPENZAAK_TAG in compose alone
reports openzaak + oz-celery, and adding a workload to values.yaml alone reports it
by name.