ci(llms-full): regen via pre-commit hook; CI verifies sync

[kumaakh]

Summary

Replaces the post-merge auto-push approach with a simpler, lower-attack-surface design:

1. Pre-commit hook (auto-installed via npm install) regenerates llms-full.txt whenever a staged file could affect its content (any .md, llms.txt itself, or scripts/gen-llms-full.mjs). The regenerated file is auto-staged into the same commit. Dev sees nothing unless they bypass the hook.
2. CI's build-and-test job (ubuntu-latest only) re-runs the generator and fails if llms-full.txt is stale. Catches --no-verify bypass and devs who skipped npm install.

Why this over the post-merge auto-push pattern

Considered (and rejected):

• The original update-llms-full job that committed back to the PR branch as github-actions[bot] -- contaminated PR heads with bot commits and made required status checks land on a SHA no one expected, breaking merge. (Confirmed during the recent feat/agy-support merge.)
• A post-merge push-to-main approach using the apra-fleet-git GitHub App as a ruleset bypass actor -- required a long-lived App private key in repo secrets, which is exfiltratable by anyone with workflow write access. Effectively gave admin-equivalent push capability to anyone who can land a workflow change. Too much attack surface for the actual requirement.

The hook + CI-check pattern needs zero new secrets, no branch-protection bypass actors, no GitHub Apps, and no env-with-reviewers. The file is committed by the dev's own commit (transparently), so it naturally lands in the PR's squash commit through normal git flow.

Changes

• .github/hooks/pre-commit: keeps existing portability checks (non-ASCII, PS backtick), adds an llms-full.txt regen block guarded by "did the staged set include any input to gen-llms-full.mjs?"
• .github/workflows/ci.yml:
  • Adds "Verify llms-full.txt is up to date" step inside build-and-test (ubuntu-latest only), so it's automatically a required check via the existing build-and-test (ubuntu-latest) context.
  • Removes the old update-llms-full job.
  • Removes llms-full.txt from paths-ignore (no longer needed -- the file is always part of the dev's commit, not bot pushes).

Test plan

• Manual test of the pre-commit hook (edit a .md file, commit -- hook regenerates and stages llms-full.txt)
• CI check fails on intentionally stale llms-full.txt (verified locally by manually staling it)
• CI check passes when llms-full.txt is current
• After merge: confirm next PR that touches a .md file results in llms-full.txt being included in that PR's diff automatically, with no separate bot commit

Co-Authored-By: Claude Opus 4.7 noreply@anthropic.com