Add CI guardrail checks and optional tool inventory

[hun99999]

Summary

• add GitHub Actions CI for tests, repo-only agent stack audit, optional tool inventory, private path scan, and whitespace checks
• add read-only optional tool inventory and private path scanning scripts
• add repo-only audit mode for CI environments without local Codex/Claude CLIs
• document the optional inventory command and map the vibe-coding checklist to repository artifacts
• remove concrete local path examples found by the new private path scan

Verification

• python3 -m unittest discover -s tests -p 'test_*.py'
• python3 scripts/audit_agent_stack.py
• python3 scripts/audit_agent_stack.py --repo-only
• python3 scripts/check_private_paths.py
• python3 scripts/inventory_optional_tools.py --json
• git diff --check
• find scripts tests .codex .opencode -type f -name '*.py' -print0 | xargs -0 python3 -m py_compile

Notes

• The inventory script is read-only and never installs optional tools.
• OpenCode remains optional and is still missing from PATH in the local audit.