Align Codex verification wrapper with CI checks

[cmsjade5000]

Goal

Make local Codex verification and GitHub CI agree on what counts as green.

Context

CI runs OpenAPI/client drift checks in addition to lint/tests, while make codex.full can diverge from that contract. Contributors should be able to run one documented local command and know whether CI is likely to agree.

Suggested Scope

• Compare .github/workflows/ci.yml, Makefile, Makefile.txt, and scripts/codex_check.sh.
• Decide which checks belong in the quick path versus full path.
• Ensure OpenAPI/client drift is covered in the appropriate full verification path.
• Document the expected commands for contributors and Codex runs.
• Keep expensive or integration-only checks clearly marked.

Files or Areas

• .github/workflows/ci.yml
• scripts/codex_check.sh
• Makefile
• Makefile.txt
• README.md
• CONTRIBUTING.md
• tests/test_github_workflows.py

Out of Scope

• Rewriting the CI workflow from scratch
• Adding new required external services for ordinary PRs
• Running destructive database reset commands as part of default verification

Acceptance Criteria

• make codex.full and CI no longer disagree silently on OpenAPI/client drift.
• The quick path remains fast enough for normal iteration.
• Docs explain when to use make codex.check, make codex.full, and make codex.live.
• A focused test or workflow assertion prevents future drift.

Verification

• make codex.check
• make codex.full
• pytest tests/test_github_workflows.py

Contributor Notes

This is a helpful repo-maintenance issue. Forked PRs are welcome, but please avoid unrelated dependency updates or workflow rewrites unless they are required for this verification contract.

[cmsjade5000]

Tracking parent: #202

Tags/workstream: ops, ci, verification.

Dependency note: Recommended first-batch release-safety issue. Coordinate with #198 so local live verification and CI/Codex verification remain complementary, not divergent.