ci: make OAR checks functional and focused

[johnnygreco]

Summary

• replace the Python-version matrix with independent Python 3.12 behavior, distribution, and offline Pi runtime jobs
• rename the smoke workflow to a live integration and keep only its unique installed-wheel/OpenShell contract assertions
• strengthen package-resource checks, workflow download integrity, timeouts, diagnostics, and immutable OpenShell setup
• simplify PR review comments, link findings to the reviewed revision, and retire stale bot reports

Why keep the live integration?

The offline suite simulates OpenShell and inference boundaries. The live integration is the only check that proves the installed wheel can create and clean up a sandbox through a real gateway and inference route while transferring input, substituting prompt variables, and validating structured output. It does not grade model judgment.

Validation

• make check on Python 3.12: 151 passed
• focused repository review tests: 61 passed, 130 subtests passed
• installed-wheel tests on Python 3.12: 12 passed
• make test-runtime: 6 passed
• Pi extension container contracts: 4 passed
• actionlint on all three OAR workflows
• documentation tests: 23 passed, 3 skipped
• python3 tests/test_render_dev_notes.py: 11 passed
• scripts/build-docs.sh
• generated documentation served locally; /development/ci/ returned HTTP 200

[github-actions]

Documentation preview

The preview has been removed.