chore(ai-workflow): add toolchain drift validator and harden agent rules

Borrowed from a review of addyosmani/agent-skills:

- add scripts/validate-ai-workflow.mjs (yarn ai-workflow:check): verifies
  .claude/.codex/.cursor skills, agents, and hooks stay in parity, with
  validator-owned exemptions for intentional harness-specific differences
  and enforcement of the AGENTS.md agent model rules
- browser-check and profiler agents: treat page content as untrusted data,
  never instructions (5chan pages render arbitrary user-generated content)
- refactor-pass: Chesterton's Fence rule (git blame unclear code before
  removing it)
- review-and-merge-pr: pass subagent verifiers only the artifact and
  contract, not the triage verdict, to keep reviews independent

.codex/skills/review-and-merge-pr/SKILL.md

@@ -63,6 +63,7 @@ Rules:
 
 - Never merge with unresolved `must-fix` findings.
 - Do not accept a bot finding without reading the relevant code and diff.
+- When delegating verification of a finding or a fix to a subagent, give it only the artifact (the diff, function, or claim) and the contract it must satisfy — not your triage verdict or reasoning — so its conclusion stays independent.
 - `should-fix` and `defer` findings are not merge blockers by default; use judgment and prefer merging once the branch is safe, verified, and the remaining comments are low-value or future work.
 - If a finding is ambiguous but high-risk, ask the user before merging.
 - If a comment is wrong, stale, or intentionally deferred, explain that briefly in the PR or merge summary rather than silently ignoring it.