ci(smoke): add token-usage sanity checks to smoke workflows

Add a verify_token_usage job to smoke-copilot, smoke-claude, and
smoke-codex that runs after the agent job on the downloaded agent
artifact and fails the workflow when token accounting looks wrong.

The checker (scripts/ci/check-token-usage.js) enforces two invariants:
- Internal consistency: the sum of per-response records in
  token-usage.jsonl must exactly equal the aggregated agent_usage.json
  (input/output/cache_read/cache_write). This is engine-independent.
- cache_read_tokens must not be 0 across multiple responses, which is
  the symptom of the cached-token normalization bug.

ai_credits/ambient_context drift is reported as warnings only.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: lpcox

.github/workflows/smoke-claude.lock.yml

@@ -23,6 +23,25 @@ sandbox:
   mcp:
     version: v0.3.1
 strict: false
+jobs:
+  verify_token_usage:
+    needs: agent
+    if: always() && needs.agent.result != 'skipped' && needs.agent.result != 'cancelled'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - name: Download agent artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: agent
+          path: /tmp/gh-aw-agent
+      - name: Token-usage sanity check
+        run: node scripts/ci/check-token-usage.js --artifact-root /tmp/gh-aw-agent --engine claude
 tools:
   bash:
     - bash

.github/workflows/smoke-claude.md

@@ -22,6 +22,25 @@ sandbox:
   mcp:
     version: latest
 strict: false
+jobs:
+  verify_token_usage:
+    needs: agent
+    if: always() && needs.agent.result != 'skipped' && needs.agent.result != 'cancelled'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - name: Download agent artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: agent
+          path: /tmp/gh-aw-agent
+      - name: Token-usage sanity check
+        run: node scripts/ci/check-token-usage.js --artifact-root /tmp/gh-aw-agent --engine codex
 imports:
   - shared/gh.md
   - shared/reporting.md

.github/workflows/smoke-codex.lock.yml

@@ -45,6 +45,25 @@ sandbox:
   mcp:
     version: v0.3.1
 strict: false
+jobs:
+  verify_token_usage:
+    needs: agent
+    if: always() && needs.agent.result != 'skipped' && needs.agent.result != 'cancelled'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - name: Download agent artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: agent
+          path: /tmp/gh-aw-agent
+      - name: Token-usage sanity check
+        run: node scripts/ci/check-token-usage.js --artifact-root /tmp/gh-aw-agent --engine copilot
 steps:
   - name: Pre-compute smoke test data
     id: smoke-data