ci: stop executing an unpinned latest OMP install in the advisory step

The advisory job installed @oh-my-pi/pi-coding-agent@latest and ran
the bridge suite against it on every CI run -- mutable, unpinned
third-party code executing unconditionally. Replace the install-and-
run with a download-only check: fetch the package with install scripts
disabled, then statically compare index.ts's imported path-utils
symbols against that file's declared exports as plain text. The
downloaded package is never imported or executed, but the same
upstream symbol move (isReadableUrlPath, pi-coding-agent -> pi-tui)
that motivated this step still surfaces.

Author: andrebrait

.github/workflows/ci.yml

@@ -108,21 +108,40 @@ jobs:
       - name: Run OMP bridge tests
         run: GRAPHIFY_TEST_CLI=$PWD/.venv/bin/graphify bun test tests/omp.test.ts
 
-      - name: Run OMP bridge tests against the latest OMP (advisory)
-        # bun install --frozen-lockfile above only proves the bridge works
-        # against the exact pinned version. Upstream OMP has moved exported
-        # symbols between minor releases before (isReadableUrlPath moved from
+      - name: Check for upstream symbol moves (advisory, no execution)
+        # The frozen run above only proves the bridge works against the
+        # exact pinned version. Upstream OMP has moved exported symbols
+        # between minor releases before (isReadableUrlPath moved from
         # pi-coding-agent to pi-tui) without the frozen lockfile ever seeing
-        # it; index.ts now vendors that predicate locally instead of tracking
-        # whichever package currently exports it. Install whatever OMP
-        # publishes today and re-run the suite so a future move to
-        # @oh-my-pi/pi-coding-agent's exports still surfaces here.
+        # it; index.ts now vendors that predicate locally instead of
+        # tracking whichever package currently exports it. This step used
+        # to install @latest AND execute the whole suite against it --
+        # unpinned, mutable third-party code running on every CI invocation.
+        # It now only downloads the published package (--ignore-scripts:
+        # no install hooks run) and statically compares index.ts's imported
+        # path-utils symbols against that file's declared exports as plain
+        # text -- the downloaded code is never imported or executed, but a
+        # future symbol move still surfaces here.
         # continue-on-error: an unrelated upstream release must not block a
         # merge; the frozen run above stays the blocking gate.
         continue-on-error: true
         run: |
-          bun add --cwd graphify/omp -d @oh-my-pi/pi-coding-agent@latest
-          GRAPHIFY_TEST_CLI=$PWD/.venv/bin/graphify bun test tests/omp.test.ts
+          bun add --cwd graphify/omp -d @oh-my-pi/pi-coding-agent@latest --ignore-scripts
+          bun -e '
+          const fs = require("node:fs");
+          const index = fs.readFileSync("graphify/omp/index.ts", "utf8");
+          const block = index.match(/import\s*{([^}]+)}\s*from\s*"@oh-my-pi\/pi-coding-agent\/tools\/path-utils"/);
+          if (!block) throw new Error("no path-utils import block found in index.ts");
+          const imported = block[1].split(",").map((s) => s.trim()).filter(Boolean);
+          const source = fs.readFileSync("graphify/omp/node_modules/@oh-my-pi/pi-coding-agent/src/tools/path-utils.ts", "utf8");
+          const exported = new Set([...source.matchAll(/^export\s+(?:async\s+function|function)\s+(\w+)/gm)].map((m) => m[1]));
+          const missing = imported.filter((name) => !exported.has(name));
+          if (missing.length) {
+            console.error(`@oh-my-pi/pi-coding-agent@latest no longer exports: ${missing.join(", ")}`);
+            process.exit(1);
+          }
+          console.log(`ok: every imported symbol is exported by @latest (${imported.join(", ")})`);
+          '
 
   security-scan:
     # The dev deps include bandit and pip-audit. Run them in CI so a new