Diagram procedure: forbid workload-driven shape, warn at runtime

The Codex session showed why the workload-driven mode is the wrong
default. Codex authored a spec under
``tenancy → regions → compartments → services`` (the documented
"workload-driven" mode), generated two .drawio files, and reported
success. The output was unusable: services rendered as colored
rectangles with text instead of OCI icon stencils, connector text
went into the edge value (forbidden by the connector-label rule),
and the spec validator never ran because it only fires on
``absolute_layout`` blocks.

Diego: "los drawio son horribles, por que sucede eso?".

Three persistent fixes:

1. SKILL.md option 2 now says ``absolute_layout`` is REQUIRED for
   step 3, calls out workload-driven explicitly as forbidden, and
   explains *why* (no stencils, no validator).

2. docs/skill/output-formats.md § Diagram modes is rewritten — mode
   1 is ``absolute_layout`` (REQUIRED), mode 2 is workload-driven
   (DEPRECATED, back-compat only). Removes the "two acceptable
   shapes" framing that let Codex pick the wrong one.

3. ``oci_diagram_gen.py`` now prints a loud stderr WARNING when a
   spec takes the workload-driven path, naming the procedure docs.
   Catches any agent that skipped reading SKILL.md before generating.

Codex copy synced via ``make sync-skill``.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/oci_diagram_gen.py

@@ -2198,6 +2198,30 @@ class OCIDiagramGenerator:
             gen._render_absolute_layout(spec)
             return gen
 
+        # Legacy workload-driven shape (tenancy → regions → compartments
+        # → services). Does NOT resolve OCI stencils — services render
+        # as colored rectangles with text labels — does NOT run through
+        # the spec validator, and bakes connector text into edge values
+        # (forbidden by the connector-labels rule). Output looks like a
+        # wireframe placeholder, not an architecture diagram. Loud
+        # warning so any agent that takes this path against the
+        # procedure docs sees the problem immediately, even if it
+        # skipped reading SKILL.md option 2.
+        import sys as _sys
+        if spec.get("tenancy") or spec.get("regions") or spec.get("clouds"):
+            print(
+                "[oci_diagram_gen] WARNING: spec uses the legacy "
+                "workload-driven shape (tenancy → regions → "
+                "compartments → services). This mode does NOT resolve "
+                "OCI icon stencils, does NOT run the spec validator, "
+                "and produces wireframe-looking output. The standard "
+                "procedure (SKILL.md option 2 / docs/skill/output-formats.md) "
+                "requires the `absolute_layout` shape. Re-author the "
+                "spec under `absolute_layout:` for any customer-facing "
+                "diagram.",
+                file=_sys.stderr,
+            )
+
         # External actors (users, internet, third-party)
         for ext in spec.get("external", []):
             ext_id = ext.get("id", gen._next_id())