Part of #1431.

Summary

The gate currently treats any change to recipes/registry.yaml (or recipes/overlays/base.yaml) as a broad-impact event and promotes every leaf recipe to "affected" (promote_all=true in recipe-evidence-check.sh). PR #1418 only changed the aws-efa registry entry, yet the gate flagged non-AWS recipes (e.g. h100-gke-cos-training) as drifted. Tighten the cascade to the recipes that transitively reference the specific registry entries / component values that changed.

Motivation / Context

• The registry is the canonical source for per-component defaults, so the whole-file "registry changed → all recipes affected" heuristic is correct-but-coarse: an aws-efa-only edit can't change the rendered digest of a recipe that never references aws-efa.
• The material-slice model (docs/design/007-recipe-evidence/04-material-slice-algorithm.md) already defines a recipe's material inputs as the registry entries for components that recipe transitively references — the gate's file-level promotion is coarser than the documented model.

Proposed approach

• Diff registry.yaml at the entry (component) level rather than file level; build the set of changed component names.
• Mark a recipe affected only if its resolved component set intersects the changed components. The digest re-computation (aicr evidence digest -r) is the ground truth — a recipe whose digest is unchanged shouldn't be listed as drifted regardless of promotion.
• Consider: skip listing a "promoted" recipe entirely when its recomputed digest matches its committed pointer (no drift = no row) — this also shrinks the scary list from the curation issue.
• Apply the same treatment to base.yaml if feasible (base-chain membership is already computed for the ancestor rule).

Acceptance criteria

• An aws-efa-only registry edit flags only recipes that reference aws-efa.
• Recipes whose recomputed digest matches their pointer are not reported as drifted.
• Behavior documented in 04-material-slice-algorithm.md / 09-ci-and-maintainer.md.

References

• .github/scripts/recipe-evidence-check.sh (promote_all, affected-detection rules, digest compare)
• aicr evidence digest: pkg/cli/evidence_digest.go, pkg/evidence/attestation/recipe_digest.go
• Material model: docs/design/007-recipe-evidence/04-material-slice-algorithm.md