ci: verify .codex/skills stays in sync with .claude source (#234)

Adds a CI workflow running `gen_codex_skills --check` on PRs (and pushes to
main) that touch the Claude skill sources, the generated Codex tree, or the
generator itself. Until now nothing enforced the regeneration step, so a
hand-edit to .claude/skills/ without re-running the generator could ship a
stale .codex/skills/ tree (the exact failure mode behind the #232 identity
drift). Fix locally with `cd cli && cargo run --bin gen_codex_skills`.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: montfort

.github/workflows/ci.yml

@@ -0,0 +1,43 @@
+name: CI
+
+on:
+  pull_request:
+    paths:
+      - 'dist/.claude/skills/**'
+      - 'dist/.codex/skills/**'
+      - 'cli/src/bin/gen_codex_skills.rs'
+      - '.github/workflows/ci.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'dist/.claude/skills/**'
+      - 'dist/.codex/skills/**'
+      - 'cli/src/bin/gen_codex_skills.rs'
+      - '.github/workflows/ci.yml'
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  codex-skills-sync:
+    name: Codex skills in sync with Claude source
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install OpenSSL (Linux)
+        run: sudo apt-get update && sudo apt-get install -y libssl-dev pkg-config
+
+      - name: Verify .codex/skills is regenerated from .claude/skills
+        working-directory: cli
+        run: |
+          # Fails if dist/.codex/skills/ drifted from what gen_codex_skills would
+          # produce from dist/.claude/skills/. Fix locally with:
+          #   cd cli && cargo run --bin gen_codex_skills
+          cargo run --quiet --bin gen_codex_skills -- --check