ci(smoke): add token-usage sanity checks to smoke workflows

.github/workflows/smoke-claude.md

@@ -23,6 +23,25 @@ sandbox:
   mcp:
     version: v0.3.1
 strict: false
+jobs:
+  verify_token_usage:
+    needs: agent
+    if: always() && needs.agent.result != 'skipped' && needs.agent.result != 'cancelled'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - name: Download agent artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: agent
+          path: /tmp/gh-aw-agent
+      - name: Token-usage sanity check
+        run: node scripts/ci/check-token-usage.js --artifact-root /tmp/gh-aw-agent --engine claude
 tools:
   bash:
     - bash

.github/workflows/smoke-codex.md

@@ -22,6 +22,25 @@ sandbox:
   mcp:
     version: latest
 strict: false
+jobs:
+  verify_token_usage:
+    needs: agent
+    if: always() && needs.agent.result != 'skipped' && needs.agent.result != 'cancelled'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - name: Download agent artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: agent
+          path: /tmp/gh-aw-agent
+      - name: Token-usage sanity check
+        run: node scripts/ci/check-token-usage.js --artifact-root /tmp/gh-aw-agent --engine codex
 imports:
   - shared/gh.md
   - shared/reporting.md

.github/workflows/smoke-copilot.md

@@ -45,6 +45,25 @@ sandbox:
   mcp:
     version: v0.3.1
 strict: false
+jobs:
+  verify_token_usage:
+    needs: agent
+    if: always() && needs.agent.result != 'skipped' && needs.agent.result != 'cancelled'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - name: Download agent artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: agent
+          path: /tmp/gh-aw-agent
+      - name: Token-usage sanity check
+        run: node scripts/ci/check-token-usage.js --artifact-root /tmp/gh-aw-agent --engine copilot
 steps:
   - name: Pre-compute smoke test data
     id: smoke-data