Set Cloudtrail pipeline description (plan-comment test)

[behobu]

Exercises the monad-plan workflow. Expected plan: one UPDATE pipeline:cloudtrail (description changed), everything else NO-OP. No apply runs until this is merged.

[github-actions]

Monad reconcile plan

Monad reconcile plan — org jfrog-417c (1f371e3e-09f1-4bd3-8302-33d130d1c659)

NO-OP   input:org-cloudtrail-logs
NO-OP   transform:drop-low-value-fields
NO-OP   transform:drop-cloudtrail-duplicated-data
NO-OP   output:sink

Pipelines: UPDATE pipeline:cloudtrail
  reason: computed spec hash differs from .monad-lock.json last_applied_hash
          (desired=5d9e11256c5b6846a7d615cc4c5d224b28378747993f6bf55f978943c0429fc4,
          locked=80d184b684355c8b207181a9b790a501540c3b5c05748835dcd47eae7bf05441)
  observed drift: live pipeline `description` is "" but desired is
          "CloudTrail control-plane events, field-trimmed, to a demo sink."
          nodes/edges/retention_policy otherwise match desired (same slugs,
          component refs resolve to the same live component ids, same edge
          topology, retention_policy 3Gi/72h unchanged).

Summary: 0 create, 1 update, 0 prune, 4 no-op

Notes:
- All 5 lockfile entries GET'd successfully live (no 404s, no self-heal needed).
- No lockfile entries are missing a corresponding monad/** file — nothing to prune.
- input:org-cloudtrail-logs settings contain env: refs (env:MONAD_CT_BUCKET,
  env:MONAD_CT_ROLE_ARN); no action needed for it this run since it is NO-OP.
- No enrichments present under monad/.
- Plan mode: zero write calls made to the Monad API; .monad-lock.json not modified.