ci: compose CI from devenv's building blocks

[ajslater]

Summary

ci.yml becomes a caller of devenv's CI building blocks (the devenv-* workflows and actions, copied in by make update-devenv), plus codex's own image jobs. It's the same design as the September gate/matrix/release work, now shared with the other repos and tested in devenv.

Job	What changed
ci	devenv-check.yml with ci-target: codex-ci and the same four checks, described below.
build	Unchanged in substance. The version now comes from ci's outputs, not from grepping pyproject.toml.
deploy	Manifest, then PyPI through devenv-pypi (uv publish --check-url, so a re-run skips files already on PyPI).
deploy-hub	Final releases only, now enforced at the job level instead of by skipping steps.
release	devenv-release.yml: tag, GitHub Release, merge-back. Runs after deploy and deploy-hub.

What devenv-check does inside ci:

• Gate: runs the Release Preflight on main pushes and PRs into main.
• Dist reuse: on a main push, reuses the python-dist of an earlier run that passed on the same git tree. It keys on the tree hash, replacing the "last merged PR" lookup, and ignores runs from forks.
• One CI image: a single image job builds codex-ci and pushes it by digest to ghcr.io/ajslater/codex-ci. The four checks pull it instead of each building and loading their own. In bochord's pilot this cut runner time by 40%.
• Required check: becomes CI / Lint, Test & Build Dist.

Every later job reads ci's outputs (deploy, release, version, final) instead of testing the event, and gates on !cancelled() plus an explicit needs.X.result.

Removed:

• .github/actions/ci-container, now devenv's devenv-ci-container.
• tests/test_release_tag_script.py and the engine tests in tests/test_release_info.py. devenv owns and tests the release engine now; codex keeps its golden NEWS.md tests.

Also updated: tests/test_ci_workflow.py now pins how codex wires the blocks. CLAUDE.md describes the new graph, and its Docker section now matches the actual Dockerfile stages.

Also fixes CI Lint, which was already broken on develop.

• Since the ESLint preset fix (fix(lint): make the ESLint base presets actually apply #931, refactor(frontend): fix the findings parked by the ESLint preset fix #932), import-x/no-unresolved resolves the frontend's @/choices/*.json imports.
• bin/build-choices.sh generates those files, and git ignores them.
• CI's fresh container had never built them, so this PR's first run failed Lint with 19 unresolved imports. Those two PRs merged into develop without running CI, so this was the first CI Lint since.
• cfg/codex.mk now gives lint and fix the same build-choices prerequisite that test-frontend and build already have.

The first commit is a routine make update-devenv:

• the .circleci ignore lines are retired
• the ESLint base config now lints Markdown code blocks, which reformats the YAML example in docs/DOCKER.md
• one dependency bump

Required check on main

Done: main's branch protection now requires CI / Lint, Test & Build Dist (GitHub Actions app, strict) instead of Lint, Test & Build Dist.

Test plan

• make fix, make lint (including actionlint on every workflow) and make ty pass
  • basedpyright reports two "unreachable code" warnings in codex/views/browser/annotate/cover.py, which this PR doesn't touch
• make lint from a checkout with no generated choices (CI's conditions): build-choices runs first and lint passes
• make test:
  • Python: 1568 passed, 1 known xfail
  • frontend: 930 passed
• This PR's run:
  • Gate
  • CI Image builds codex-ci and pushes it by digest
  • Lint, Test Frontend, Test Python and Build Dist pull it and pass
  • CI / Lint, Test & Build Dist is green
  • the ci-passed-<tree> marker and python-dist are uploaded
• build, deploy, deploy-hub and release first run on a pre-release PR or the next main push

🤖 Generated with Claude Code