feat(codemap-py): integrate engine, Codex skills

- Add the `codemap-py integrate` control plane (new `src/codemap_py/integration.py`, dispatched from `cli.py`): `check` reports installed/active versions, roots, protocol, shared-index identity, and runtime-log isolation with no writes; `plan` persists an inspectable artifact (exact targets, before-state hashes, argv arrays, ordered operations, rollback identities) bound by a SHA-256; `apply` updates only the sentinel-bounded managed block (`<!-- codemap-py:integration:begin v1 sha256=… -->`) inside allowlisted consumer source files, preserving everything outside it and refusing foreign/modified markers, path escapes, symlinks, installed-cache roots, and dirty overlap; `sync` runs only the approved native plugin-manager argv and never touches source or global instructions; `demo` writes disposable evidence. Every mutation is hash-approved, journaled with before-images, and rolled back on partial failure, ending `recovery-required` when a rollback cannot be verified.
- Ship a Codex skill roster under `codex-skills/` (six SKILL.md adapters) and point the Codex manifest `skills` at `./codex-skills/`, so both runtimes expose the same six skills — scan-codebase, query-code, test-impact, rename-refs, integration, debrief-coding — with identical truth-claims and only runtime-specific invocation differing.
- Add `shared/capability-contract.md` (the single source of the six skills' inputs, outputs, exit codes, completeness metadata, and caveats) and `shared/integration-contract.md` (the `codemap-py.integration.v1` marker, plan, approval, journal, and rollback shapes).
- Rewrite the Claude `integration` skill from the retired `check|init|demo` cache-injection model to `check|plan|apply|sync|demo`, deleting its legacy demo modes and template; update `scan-codebase`'s NOT-for pointer off the retired `integration init`.
- Teach `build_package.py` to ship `codex-skills/` and `shared/` and record the Codex roster in the manifest, and invert `validate_package.py` from the former Codex zero-roster rule to enforcing Codex/Claude six-skill parity (the no-Codex-hooks rule is unchanged).
- Add `tests/integration/test_skill_parity.py`, `test_integrate.py`, and `test_optionality.py` (roster/truth-claim parity; check/plan zero-write, approval digest, refusal matrix, journal transitions, rollback in both partial-failure orders, Windows argv quoting, demo; provider-only lane); flip the stale Codex zero-roster assertions to the six-skill contract; drop the retired manual-injection README-drift guard and the orphaned `measure_demo_arms` demo helper and its test.
- Bump both plugin manifests to 0.26.0 and record the release in README.md and CHANGELOG.md.

---
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>

Author: Borda

plugins/codemap-py/.claude-plugin/plugin.json

@@ -19,5 +19,5 @@
   "name": "codemap-py",
   "repository": "https://github.com/Borda/AI-Rig",
   "skills": "./claude-skills/",
-  "version": "0.25.1"
+  "version": "0.26.0"
 }

plugins/codemap-py/.codex-plugin/plugin.json

@@ -8,5 +8,6 @@
   "license": "Apache-2.0",
   "name": "codemap-py",
   "repository": "https://github.com/Borda/AI-Rig",
-  "version": "0.25.1"
+  "skills": "./codex-skills/",
+  "version": "0.26.0"
 }

plugins/codemap-py/CHANGELOG.md

@@ -6,6 +6,38 @@ repository directory, and skill namespace change. Pre-`0.25.0` history was recor
 `codemap` under `plugins/codemap/` — see the repository git history for that line; it is
 not reproduced here.
 
+## 0.26.0
+
+- **Dual-runtime skill parity.** `codemap-py` now ships a Codex skill roster under
+  `codex-skills/` alongside the existing Claude roster under `claude-skills/`, and the
+  Codex manifest points `skills` at `./codex-skills/`. Both runtimes expose the same six
+  skills — `scan-codebase`, `query-code`, `test-impact`, `rename-refs`, `integration`,
+  and `debrief-coding` — with identical truth-claims (inputs, outputs, exit codes,
+  completeness metadata, caveats), differing only in runtime-specific invocation (Codex
+  resolves an explicit plugin-root path and has no `bin/` PATH or `AskUserQuestion` tool).
+  A shared capability contract (`shared/capability-contract.md`) is the single source of
+  those truth-claims, and a parity test rejects missing skills, stale command names,
+  unsupported cache paths, or contradictory limits. Codex still ships no hooks in this
+  release — a documented automation limitation, not hidden parity.
+- **Native `integrate` control plane** (`codemap-py integrate check|plan|apply|sync|demo`,
+  surfaced as `/codemap-py:integration` and `$codemap-py:integration`). `check` is a
+  read-only health report; `plan` persists an inspectable artifact (exact targets,
+  before-state hashes, argv arrays, ordered operations, rollback identities) bound by a
+  SHA-256; `apply` updates only sentinel-bounded managed blocks inside allowlisted
+  consumer source files (marker `<!-- codemap-py:integration:begin v1 sha256=… -->`),
+  preserving everything outside the block byte-for-byte and refusing foreign/modified
+  markers, path escapes, symlinks, installed-cache roots, or dirty overlap; `sync` runs
+  only the approved native plugin-manager argv and never mutates source or global
+  instructions; `demo` records disposable evidence. Every mutation is dry-run-first,
+  hash-approved, journaled with before-images, and rolled back on partial failure, ending
+  `recovery-required` if a rollback cannot be verified. This replaces the retired
+  installed-cache `init` injection model.
+- The Claude `integration` skill was rewritten from the retired `check|init|demo` model to
+  `check|plan|apply|sync|demo`; the legacy demo A/B measurement helper was removed. The
+  package builder now ships `codex-skills/` and `shared/` and records the Codex skill
+  roster in the manifest, and the package validator now enforces Codex six-skill parity in
+  place of the former zero-roster rule. Both plugin manifests move to `0.26.0`.
+
 ## 0.25.1
 
 - Extracted the two monolithic `bin/` executables into an importable