docs: correct bootstrap dependency check description

[Tmwakalasya]

CONTRIBUTING.md describes bootstrap as running go mod tidy and potentially rewriting dependency files. Update it to document go mod tidy -diff: when the manifests need changes, the check prints a diff and exits without rewriting them. Dependency download and verification follow a successful check.

Validation:

• go test ./scripts -run '^TestBootstrap' -count=1 (passed)
• git diff --check (passed)

[saioai]

Description matches scripts/bootstrap: it checks module files without rewriting them, then downloads and verifies dependencies. Looks good to me.

[github-actions]

Castiron custom code

✅ No new custom-code files detected.

5 mixed files remain; 0 existing customizations changed.

Compared 225dacc174a8 → ac4091237a46. Generated baselines verified.

5 existing customizations unchanged

• pkg/cmd/adminorganizationcertificate.go
• pkg/cmd/cmd.go
• scripts/castiron/README.md
• scripts/castiron/custom_code_report.py
• scripts/castiron/test_custom_code_report.py

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 34660639391 --repo openai/openai-cli \
  --name castiron-custom-code-34660639391-1 --dir /tmp/castiron-custom-code-34660639391-1
git apply --stat /tmp/castiron-custom-code-34660639391-1/custom-code.patch
cat /tmp/castiron-custom-code-34660639391-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 225dacc174a81058499aae6a4f18f558d1e4680c ac4091237a461727a2c3e9f92eeff5d296776bab
python3 scripts/castiron/custom_code_report.py report \
  --base 225dacc174a81058499aae6a4f18f558d1e4680c \
  --head ac4091237a461727a2c3e9f92eeff5d296776bab --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-ac4091237a46
cat /tmp/castiron-custom-code-ac4091237a46/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T00:09:19.980513Z	ac40912	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.