SKILL.md sync: reject isolated edits to the .agents/ copy

Diego asked the right question: what if someone edits the Codex
side directly? Until now the sync was unidirectional (root →
.agents/) but the hook only fired when root SKILL.md was staged —
isolated .agents/ edits sneaked past the hook locally and only got
caught by CI's --check. A future ``make sync-skill`` would then
silently destroy them.

Hardened both layers to reject the asymmetric case at the moment
of the commit/PR:

- Pre-commit hook now classifies the staged set and REJECTS
  commits that stage .agents/skills/.../SKILL.md in isolation,
  with a step-by-step message: move the edit into root SKILL.md
  and re-stage. The hook still auto-syncs when root SKILL.md is
  staged.

- CI gate adds a second step (PR-only) that diffs the PR's base
  against head; if .agents/ moved but root SKILL.md didn't, fails
  with an actionable error before the build proceeds.

- README documents the direction explicitly: edits land in root
  SKILL.md; .agents/ is auto-generated; Codex-specific instructions
  belong in AGENTS.md, not in the SKILL.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -472,6 +472,8 @@ Three layers of defense, run from least to most enforcement:
 
 3. **CI gate (`.gitea/workflows/skill-sync.yaml`):** every push/PR runs `python scripts/sync-skill.py --check` and fails the build if the two files have drifted. Catches anyone who skipped the hook.
 
+**Direction is always root → `.agents/`.** The `.agents/` copy is auto-generated; do NOT edit it directly — the next sync will silently overwrite your changes. Both the local pre-commit hook and the CI gate REJECT a commit/PR that stages `.agents/skills/oci-deal-accelerator/SKILL.md` without a matching root `SKILL.md` change. If you find yourself wanting to tweak the Codex side specifically, that signal belongs in `AGENTS.md` (Codex-only project instructions) — `SKILL.md` content stays unified across both agents.
+
 ## Roadmap
 
 ### ECAL Completeness (see `docs/ecal-gaps-backlog.md` for full list)