Tighten repo hygiene and Core validation

[r3dbars]

Summary

• tightened the repo's agent verification contract around non-opening builds, script ownership checks, and GitHub template/workflow surfaces
• added a repo-hygiene GitHub Action plus stronger preflight/test-matrix coverage for shell, Ruby, Python, docs, and agent automation changes
• fixed two small Core issues: injected storage paths are now used during Audio preflight, and frontmatter reads stay capped at the maximum limit
• hardened AX bridge casting and added package-surface tests for the public TranscriptedCore API
• made the BET-88 auto-close workflow label-gated and removed hard-coded mutation of a stale child issue

Audit lanes

This came out of a five-lane audit: architecture boundaries, docs/agent contracts, build/test contracts, Swift smells, and GitHub repo hygiene.

Checks

• scripts/dev/agent-preflight.sh
• git diff --check
• shell syntax checks for root wrappers and scripts/**/*.sh
• ruby -c scripts/ops/agent-todo-runner.rb
• python3 -m py_compile for meeting corpus, nightly security, digest, and memory-index scripts
• bash build-deps.sh --force
• bash build.sh --no-open
• bash run-tests.sh
• bash run-integration-smoke.sh
• swift test

Not run

• SKIP_NOTARIZATION=1 bash build-beta.sh <token> <user-name>: not run because this PR did not change the release/package path itself; it only updated docs to prefer the non-opening build command.

[r3dbars]

verdict: no-findings-but-human

No actionable findings from this pass. The PR is broad and still draft, and it touches repo automation, verification contracts, AX casting, and the public TranscriptedCore package surface, so it should still get human/product/maintainer review before merge.

findings: none
actions: none
head_sha: 964e203
fix_commit: none
checks: gh pr view, gh pr diff --patch, gh pr checks, local subsystem docs, git diff --check origin/main...origin/codex/deep-architecture-cleanup, repo-hygiene check status, YAML parse of repo-hygiene workflow

manual_merge_handoff:
head_sha: 964e203
verdict: no-findings-but-human
blockers: draft PR; broad repo automation and public Core/package surface need human signoff
checks: gh pr view; gh pr diff --patch; gh pr checks; git diff --check; repo-hygiene passed; workflow YAML parsed