SKILL.md sync: pre-commit hook + CI gate + make install-hooks

Three-layer defense to keep root SKILL.md (Claude Code) and
.agents/skills/oci-deal-accelerator/SKILL.md (Codex) byte-aligned.
Without this, Claude Code and Codex can drift and give the user
contradictory instructions — exactly the failure mode that produced
the workload-driven-mode incident on 2026-04-25.

Layers (least → most enforcement):

1. Local pre-commit hook (.githooks/pre-commit, opt-in via
   ``make install-hooks`` which sets core.hooksPath). When SKILL.md
   is staged, auto-runs scripts/sync-skill.py and stages the
   regenerated .agents/ copy in the same commit. Idempotent.

2. ``make install-hooks`` target + a tip line in ``make venv``'s
   output so any new clone discovers the hook setup.

3. CI gate (.gitea/workflows/skill-sync.yaml) on every push/PR
   touching SKILL.md or the .agents/ copy. Runs
   ``scripts/sync-skill.py --check`` and fails the build on drift.
   Catches anyone who skipped the hook.

README documents the rationale and the three layers.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/skill-sync.yaml

@@ -0,0 +1,49 @@
+# SKILL.md sync gate.
+#
+# Why: the root SKILL.md (read by Claude Code) and
+# .agents/skills/oci-deal-accelerator/SKILL.md (read by Codex) MUST
+# stay byte-aligned modulo the auto-generated banner. If they drift,
+# the two agents give the user different instructions — exactly the
+# class of regression that produced the workload-driven-mode incident
+# Diego flagged on 2026-04-25.
+#
+# This workflow blocks the merge if a PR/push leaves them out of
+# sync. Locally, ``make install-hooks`` enables a pre-commit hook
+# that auto-syncs before the commit lands; this CI step is the
+# safety net for anyone who skipped the hook.
+
+name: SKILL.md sync
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'SKILL.md'
+      - '.agents/skills/oci-deal-accelerator/SKILL.md'
+      - 'scripts/sync-skill.py'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'SKILL.md'
+      - '.agents/skills/oci-deal-accelerator/SKILL.md'
+      - 'scripts/sync-skill.py'
+  workflow_dispatch:
+
+jobs:
+  check-sync:
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends python3
+          python3 --version
+
+      - name: Verify SKILL.md is in sync with the Codex copy
+        run: |
+          python3 scripts/sync-skill.py --check