Harden cccc v2 workflows and packaging

[JTropy]

Summary

• move the canonical skill into skills/cccc/ with Codex metadata and progressive references
• replace the v1 wrappers with bounded delegate/consult workflows, shared repository locking, authenticated timeout outcomes, no-clobber publication, and Git-visible policy auditing
• add Bash 3.2-compatible helpers and cross-platform Python process/publication helpers
• document canonical .agents / .claude installation, candidate-first updates, v1 migration, rollback, and trust boundaries
• add Linux, macOS, and Windows Git Bash CI plus regression suites for symlink/FIFO/TOCTOU, signals, concurrency, dirty baselines, and Windows-specific behavior

Migration impact

• the canonical skill entrypoint is now skills/cccc/
• Codex installs at ~/.agents/skills/cccc; ~/.codex/skills/cccc is legacy-only
• Claude installs at ~/.claude/skills/cccc
• the root v1 SKILL.md, host metadata, setup reference, and wrapper entrypoints are removed
• updates use an independently validated versioned candidate before switching both live links

Local verification

• python3 -m unittest discover -s tests -p 'test_*.py' -v: 137 passed, 3 platform skips
• bash tests/test_common.sh: 42/42 passed
• bash tests/test_delegate.sh: 79/79 passed, including 2 macOS skips for Windows-native cases
• bash tests/test_consult.sh: 59/59 passed, including 1 macOS skip for the Windows-native case
• python3 tests/validate_skill.py skills/cccc: valid
• git diff --check main...HEAD: passed
• fresh-context routing review: all 3 authorization/capability scenarios passed

Optional live smoke

• both local CLIs were authenticated (codex-cli 0.147.0, Claude Code 2.1.226)
• Claude exposed and prompted a fix to the generated empty MCP schema; after the fix it passed config validation but the bounded consult timed out at 120 seconds with authenticated status 124 and cleanup
• Codex strict consult returned safely without weakening controls; the model reported that repository inspection was unavailable because code_mode_host was intentionally disabled, and made no unsupported repository claim
• these outcomes are recorded as bounded/blocker smoke evidence, not as successful end-to-end repository-reading claims

Trust boundaries

• wrappers are not an OS sandbox and do not isolate same-UID-readable secrets or intentionally detached same-UID processes
• Git metadata and Git-ignored paths are outside the Git-visible audit boundary
• consult is a second opinion, not implementation authorization or guaranteed consensus
• wrapper exit status 0 is necessary; the orchestrator must still inspect the artifacts and verify the result
• Windows-native behavior must pass the required windows-latest CI job before release

This PR is intentionally draft. Do not merge until all three CI platforms pass and the migration notes are reviewed.