CI: agents/ extension test suites are not run in CI

[lantisprime]

Summary

None of the agents/ extension test suites execute in CI. .github/workflows/ci.yml runs only web-search, tool-context-loader, and permission-policy fixtures. Every agents/test-fixtures/run-*.sh — all of P3b/P3c/P3d/P3f and the new P6-0a / P6-1 suites — is unenforced on PRs.

Root cause

The agents/ extension was built out across many slices (P3→P6), but a corresponding CI step was never added. New slices each ship a run-p6-*-tests.sh whose slice contract says "green," yet nothing runs them on push/PR. Regressions in the child-runner/child-args/router code can land on main undetected.

Surfaced during the P6-1 + P6-0a code review (Rule 18 step 6) as finding F1 — pre-existing, not introduced by P6.

Evidence

• grep -c "agents/test-fixtures" .github/workflows/ci.yml → 0
• 17 unenforced runner scripts currently in agents/test-fixtures/run-*.sh (P3b-1…P3f-4, P6-0, P6-1)
• All 18 .mjs fixtures pass locally today, so wiring them in is green from day one (no pre-existing failures to fix first)

Proposed resolution

Add CI step(s) to .github/workflows/ci.yml mirroring the existing pattern, e.g. a single step that runs each agents/test-fixtures/run-*.sh (or globs them). Aligns with the repo rule "enforce rules in CI, not just docs."

      - name: Run agents extension test suites
        run: |
          set -euo pipefail
          for s in agents/test-fixtures/run-*.sh; do
            echo "== $s =="
            bash "$s"
          done

Scope note

Pre-existing gap (predates P6). Filing as a deferred follow-up per the inline-FU heuristic; not a blocker for the P6-1/P6-0a merge.