Route skill pre-flight through Makefile to avoid hardcoded Python

Codex users hit `python: command not found` on the welcome-flow
pre-flight because SKILL.md called `python tools/kb_freshness.py`
directly. Any hardcoded version (python/python3/python3.12) breaks
for somebody — users have 3.8, 3.10, 3.11, 3.12 in the wild.

Fix: channel all skill-initiated Python calls through `make` targets
so the Makefile's single $(PYTHON) variable (auto-detected venv >
3.12 > 3.11 > 3.10 > python3) is the only place Python resolution
lives.

- Makefile: add `kb-check` target emitting JSON for the skill pre-flight
- SKILL.md + .agents/skills/.../SKILL.md: call `make kb-check` and
  `make freshness-refresh` instead of bare `python tools/...`
- CLAUDE.md: same fix in the Welcome Flow instructions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.agents/skills/oci-deal-accelerator/SKILL.md

@@ -19,7 +19,7 @@ When the user starts a conversation without providing discovery notes or a speci
 
 ### Pre-flight: KB freshness check
 
-**Before showing the welcome message**, run `python tools/kb_freshness.py --check --json` and parse the JSON output. Behavior based on the result:
+**Before showing the welcome message**, run `make kb-check 2>/dev/null` and parse the JSON output. Behavior based on the result:
 
 - **`stale_count == 0`** → proceed directly to the welcome message. No banner.
 - **`stale_count > 0` and at least one file has `refreshable: true`** → prepend this banner above the menu and ask the user inline:
@@ -30,8 +30,8 @@ When the user starts a conversation without providing discovery notes or a speci
       Refresh now before showing the menu? [y/N]
   ```
 
-  - If the user replies `y` / `yes` / `sí` → run `python tools/kb_freshness.py --auto-refresh`, wait for completion, then show the menu.
-  - If the user replies `n` / anything else → show the menu immediately, with a one-line compact reminder above it: `⚠️ <N> KB file(s) stale — run /freshness or python tools/kb_freshness.py --auto-refresh later.`
+  - If the user replies `y` / `yes` / `sí` → run `make freshness-refresh`, wait for completion, then show the menu.
+  - If the user replies `n` / anything else → show the menu immediately, with a one-line compact reminder above it: `⚠️ <N> KB file(s) stale — run /freshness or make freshness-refresh later.`
 
 - **`stale_count > 0` but no file has `refreshable: true`** (only manual files stale) → prepend a non-blocking informational banner above the menu, do NOT ask:
 

CLAUDE.md

@@ -198,7 +198,7 @@ When the user starts a conversation without providing discovery notes or a speci
 
 **MANDATORY:** Use the `Read` tool to open `SKILL.md` and read the entire `## Welcome Flow` section **before** showing anything to the user. Reproduce the welcome banner and the 14-option capability menu **verbatim** from that file. Do NOT paraphrase, reorder, summarize, translate, or reconstruct the menu from memory, folder structure, or prior conversations. If `SKILL.md` cannot be read for any reason, tell the user instead of improvising a menu.
 
-**Pre-flight check (also defined in SKILL.md):** Before showing the welcome message, run `python tools/kb_freshness.py --check --json`. If `stale_count > 0`, follow the banner-and-prompt logic in SKILL.md § Welcome Flow → Pre-flight. If the tool errors, silently skip the banner — never block the user.
+**Pre-flight check (also defined in SKILL.md):** Before showing the welcome message, run `make kb-check 2>/dev/null`. If `stale_count > 0`, follow the banner-and-prompt logic in SKILL.md § Welcome Flow → Pre-flight. If the tool errors, silently skip the banner — never block the user.
 
 Then:
 

Makefile

@@ -92,5 +92,8 @@ sync-skill: ## Regenerate .agents/skills/oci-deal-accelerator/SKILL.md from root
 freshness: ## Report stale KB files (informational, never fails)
 	-@$(PYTHON) tools/kb_freshness.py --check
 
+kb-check: ## KB freshness JSON (used by skill welcome-flow pre-flight)
+	@$(PYTHON) tools/kb_freshness.py --check --json
+
 freshness-refresh: ## Run refresh tools for stale KB files that support automation
 	@$(PYTHON) tools/kb_freshness.py --auto-refresh

SKILL.md

@@ -43,7 +43,7 @@ If the command fails (not a git repo, no network, MCP deployment), silently skip
 
 #### Check 3: KB freshness
 
-Run `python3 tools/kb_freshness.py --check --json 2>/dev/null` and parse the JSON output. Behavior:
+Run `make kb-check 2>/dev/null` and parse the JSON output. Behavior:
 
 - **`stale_count == 0`** → no banner.
 - **`stale_count > 0` and at least one file has `refreshable: true`** → prepend banner and ask inline:
@@ -53,8 +53,8 @@ Run `python3 tools/kb_freshness.py --check --json 2>/dev/null` and parse the JSO
       <M> can be auto-refreshed. Refresh now? [y/N]
   ```
 
-  - `y` / `yes` / `sí` → run `python3 tools/kb_freshness.py --auto-refresh`, then show menu.
-  - Anything else → show menu with one-line reminder: `⚠️ <N> KB file(s) stale — run python3 tools/kb_freshness.py --auto-refresh later.`
+  - `y` / `yes` / `sí` → run `make freshness-refresh`, then show menu.
+  - Anything else → show menu with one-line reminder: `⚠️ <N> KB file(s) stale — run make freshness-refresh later.`
 
 - **`stale_count > 0` but no `refreshable: true`** → non-blocking info banner, then show menu directly:
 
@@ -62,7 +62,7 @@ Run `python3 tools/kb_freshness.py --check --json 2>/dev/null` and parse the JSO
   ⚠️  KB freshness: <N> file(s) need manual review (oldest: <file> — <age_days>d).
   ```
 
-If `kb_freshness.py` errors out (exit ≠ 0, missing python, missing tool), **silently skip** — no error output, no banner, no mention of failure.
+If `make kb-check` errors out (exit ≠ 0, missing make, missing Python, missing tool), **silently skip** — no error output, no banner, no mention of failure.
 
 ### Welcome Message