Detecting firewall config drift with diffs, not audits

Firewall config drift detection is a diff problem: normalize the config, snapshot on a cadence, correlate deltas with change tickets, then verify convergence.