Fix Codex skill metadata projection

[rudijetson]

Summary

• preserve a bundled Codex agents/openai.yaml byte-for-byte during native skill reconciliation
• retain the existing generated metadata fallback when the canonical file is absent
• add a force-reconciliation regression that protects policy.allow_implicit_invocation: false

Risk And Invariants

Risk tier: medium because this changes persistent, user-visible Codex invocation metadata.

• complete-package validation occurs before bundled metadata is selected
• non-regular and symbolic-link package content fails closed
• only Codex receives agents/openai.yaml; portable hosts remain unchanged
• generated fallback behavior remains available for flat and legacy skills
• no parser, schema, dependency, live installation, release, or admin-Mac change

Proof

• behavioral red: focused test failed 0/1 because force sync emitted generated interface-only YAML
• unchanged green: focused test passed 1/1
• adjacent lifecycle/sync tests: 36/36
• full suite: 788/788
• build: passed twice; tracked dist/index.cjs reproduced at SHA-256 513d9f274fe28346f18ed55ab82894f3de36d6e2a173119da9c5485c6e3f4a24
• repository and SWE debt scans: zero findings
• package dry run: passed, six files at version 1.10.26
• isolated actual-Registry smoke: forced codex-tasks reconciliation byte-matched canonical metadata and preserved the false policy
• independent review: Standards pass, Spec pass, Proof pass, Overall pass, no findings

Detailed checklist: docs/swe-compliance/2026-09-02-codex-skill-metadata-sync.md

Human review of the metadata-precedence boundary is required before merge. This delivery stops before merge.

Fixes #42