feat(skills): progressive-disclosure split for all platforms (generator + drift fence) (#1121)

All-platform progressive-disclosure skill split + generator (addresses #1106).

Splits each platform's skill into a lean core (~615 lines, full default pipeline inline) + on-demand references/, generated from a single source via tools/skillgen with a CI/pre-commit drift gate. 13 hosts split, aider/devin stay monoliths. Also fixes the stale bare-path bugs across the previously hand-maintained variants and moves the always-on blocks into packaged markdown.

Verified: all 5 generator guards pass, byte-verbatim load-bearing slices, lean cores self-sufficient on the default path across all 13 split hosts, references gated to non-default branches, description preserves the graphify-out-query-first clause. Supersedes #1119 (Claude-first subset).

Known follow-up applied on top: harden _always_on() against a missing packaged file so a partial install can't brick the CLI.

.github/workflows/ci.yml

@@ -8,6 +8,44 @@ on:
   workflow_dispatch:
 
 jobs:
+  skillgen-check:
+    # Fast lint-style guard: the skill files under graphify/ are generated from
+    # the fragments in tools/skillgen/. This fails if someone hand-edited a
+    # generated file or forgot to re-run the generator and bless expected/, and it
+    # runs the build-time validators that guard per-host coverage, the file_type
+    # enum, the monolith round-trips, and the always-on round-trips.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          # The audit-coverage, monolith-roundtrip, and always-on-roundtrip
+          # validators read blobs from origin/v8. A shallow checkout omits that
+          # ref, so fetch the full history here and the validators run for real
+          # (rather than skipping). The other jobs stay shallow.
+          fetch-depth: 0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.1.0
+        with:
+          python-version: "3.12"
+
+      # --frozen keeps uv from re-resolving and rewriting uv.lock as a side
+      # effect of `uv run`; the lock is committed and must not churn in CI.
+      - name: Check generated skill artifacts are up to date
+        run: uv run --frozen python -m tools.skillgen --check
+
+      - name: Audit per-host v8 coverage
+        run: uv run --frozen python -m tools.skillgen --audit-coverage
+
+      - name: Check the file_type enum is a singleton
+        run: uv run --frozen python -m tools.skillgen --schema-singleton
+
+      - name: Round-trip the monoliths against v8
+        run: uv run --frozen python -m tools.skillgen --monolith-roundtrip
+
+      - name: Round-trip the always-on blocks against v8
+        run: uv run --frozen python -m tools.skillgen --always-on-roundtrip
+
   test:
     runs-on: ubuntu-latest
     strategy:
@@ -22,13 +60,15 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
+      # --frozen installs straight from the committed uv.lock without re-resolving
+      # or rewriting it, so CI never churns the lock.
       - name: Install dependencies
-        run: uv sync --all-extras
+        run: uv sync --all-extras --frozen
 
       - name: Run tests
-        run: uv run pytest tests/ -q --tb=short
+        run: uv run --frozen pytest tests/ -q --tb=short
 
       - name: Verify install works end-to-end
         run: |
-          uv run graphify --help
-          uv run graphify install
+          uv run --frozen graphify --help
+          uv run --frozen graphify install