feat(core): add agentrust-capture-core and migrate claude-code onto it

[imran-siddique]

Why

Three engines carried the same logic in three copies, and the cost was not theoretical:

• The skill-fingerprinting bypass closed in fix(skills): fingerprint the whole skill directory, not SKILL.md alone #63 had to be found and fixed again in fix(codex): digest the whole skill directory, not SKILL.md alone #65, because the second engine had it too.
• The reporting defect fixed in fix(report): never render an unmeasured category as a measured zero #62 shipped in one engine while the other kept it.

A fourth engine for Copilot would have meant writing both bugs a fourth time.

What ships

packages/agentrust-capture-core, standard library only, with a test asserting it. Owns the parts that are genuinely identical: tree_digest and the exclusion denylist, baseline sealing, the diff shapes plus observed-category and measurement-scope gating, atomic state read/write, and the report honesty vocabulary. 45 tests, ruff clean on 3.9.

Deliberately not unified: where an agent keeps its files, what its categories are called, how its report is laid out, and baseline scoping. Claude Code keeps one baseline per machine, Codex one per workspace because a workspace carries its own instructions and skills. Both are correct for their agent, so an engine supplies its own paths.

On the PyPI choice

You picked PyPI as the sharing mechanism. That conflicts with the stated promise that the SessionStart hook needs nothing installed, so both mechanisms ship: the package is the source of truth, and each engine carries a pinned vendored copy it falls back to when the package is absent.

Vendored copies are free to rot, which is exactly the failure this package exists to end, so they are generated by scripts/sync_vendored_core.py, never hand-edited, and CI fails if a copy disagrees with the package. I verified the check catches a one-line edit.

Not published. That needs credentials and is an irreversible claim on a package name, so it stays a human step. The package is publishable as-is.

claude-code is migrated, and the proof is that its tests did not change

Hashing, the skill tree digest, the denylist, sealing, and state read/write delegate to the core. Public names are retained as aliases, so all 59 existing tests run unchanged. That is the point: behaviour is proven identical by not touching the contract. 973 lines to 854.

Two behaviours deliberately did not move:

1. _sha_tree keeps its own semantics, returning the digest of the empty string for a missing tree where the core returns None. The core's distinction between "no component here" and "a component with no files" is right for components, but adopting it for the instruction rollup would move system_prompt for every existing baseline.
2. State writes are now atomic, replacing an in-place write. A strict improvement: a crash mid-write previously left a truncated baseline that read as corrupt on every future session.

Still to do

Codex and scheduled-agents get the vendored copy and are covered by the bare-install job, but still use their own implementations. Migrating them is mechanical now that the core exists and one engine proves it fits, and I kept it out of this PR so the core can be reviewed against one known-good migration rather than three at once.

Test plan

• Core: 45 passed, ruff clean at py39, no third-party imports (asserted by test).
• claude-code: 59 passed, unchanged test file.
• scheduled-agents: 21 passed. Codex: 25 passed.
• Vendored sync check passes, and was verified to fail on a deliberate one-line edit.
• Bare-install path verified locally: with the core not installed, the engine loads the vendored copy and _skill_fingerprint is core.tree_digest.

New workflow runs the core on 3.9 through 3.13, the sync check, and a bare-install job that asserts the core is not installed and then imports all three engines. That last one matters because the fallback is the path most users are on, and nothing else would notice it rotting behind the installed path.

The one Codex failure is the pre-existing TRACE conformance check that fix/codex-trace-pins addresses.