maintain-ci

# Maintain GitHub Actions CI ## Companion Guidance Use `karpathy-guidelines` alongside this skill for implementation or review work. Keep changes scoped, surface assumptions, and define focused validation before editing. Use this skill when a change touches `.github/workflows/*.yml` or `.github/workflows/*.yaml`, or when reviewing CI behavior for security, reliability, or reproducibility. ## Standards - Put `permissions:` on each job that needs token access. - Avoid workflow-level permissions unless the repository intentionally centralizes them and the inheritance tradeoff is documented. - Keep third-party actions pinned to full commit SHAs and preserve the readable version comment after the SHA. - Prefer action-native or ecosystem-native caching over generic `actions/cache`. - Use lockfiles or dependency manifests to drive cache invalidation. - Keep deploy and publish permissions isolated to the jobs that need them. - Read both caller and callee when a workflow uses `workflow_call`. - Put release-tag validation in the earliest practical caller job when the pipeline has tag-based publish behavior. - Keep release-tag policy aligned with `RELEASING.md`: raw SemVer tags only, no leading `v`. - Keep Codecov component paths aligned with new crates, packages, and generated outputs. Dynamic plugin SDK/protocol paths belong in the plugin component. - Keep pure-Python plugin SDK packaging as a single wheel artifact instead of duplicating it across every platform mat...