Model skill-only Codex plugins as zero-callable roots

[pengfei-threemoonslab]

Summary

This prerequisite fixes the self-dogfood binding gap that currently blocks PR #274. A fully parsed, warning-free skill-only Codex plugin is now modeled as a structural package root with a complete zero-callable surface, without requiring a synthetic human-authored agent_bindings declaration.

Root cause

The Codex plugin loader returned no loaded source for a package containing only skills. The binding resolver therefore saw neither tools nor a root observation and reported ambiguous_root_agent, even though the plugin manifest and skill tree had been parsed completely and exposed no apps, MCP servers, hooks, or inventories.

Changes

• Emit a structural package-root binding observation for complete skill-only Codex plugins.
• Keep the proof fail-closed when the package contains apps, MCP servers, hooks, MCP inventories, unknown manifest keys, skipped marketplace entries, component path issues, metadata defects, or source warnings.
• Surface unknown top-level plugin keys as source-warning evidence.
• Remove the synthetic reviewed empty binding from the launch-package regression test.
• Document the non-agent package-root compatibility projection and pass contract.
• Carry forward the already-approved ANSI-safe help assertion from PR Phase 1: fail closed across verifier evidence paths #274 so this prerequisite can pass current main CI independently.

No manifest, workflow, policy, agent-instruction, baseline, waiver, suppression, or schema/contract version was changed.

Validation

• Full Ruff lint: passed.
• Compileall: passed.
• Generated-schema consistency: passed.
• Docs, Codex plugin, binding and safety suites: passed.
• Static/safety/binding/multi-host canaries: passed.
• Latency budgets: passed.
• Full GitHub CI: passed (3466 tests passed, 3 skipped; coverage 88.37%).
• Both repository manifests scan as passed with zero findings and no agent_bindings declaration.
• Committed-tree verifier: decision=passed, merge_verdict=mergeable, control.state=complete.
• Reproducible verification receipt: sha256:d6321efefc903c2cde1958eeff67e4ebec441339a03383da171c8928879d3c11.

Relationship to #274

Merge this prerequisite first, then rebase #274. The rebased Phase 1 PR should no longer report insufficient_evidence; any remaining human_review_required state should be limited to its protected workflow changes.