Make engineering foundation the Codex default

[Chaddacus]

What changed

• Synchronizes both mirrored AGENTS.md contracts with the active Chad 3.0 Codex runtime contract.
• Declares codex-engineering-foundation@codex-engineering-foundation as the default repository-engineering workflow layer.
• Registers the foundation's stable GitHub marketplace source and enables the plugin in mirrored config.toml.
• Documents plugin and isolated CLI restoration commands.

Why

The foundation had been built and tested but was not active in the machine-wide Codex runtime. The private runtime mirror was also behind the current global contract, so it could not reproducibly restore the new default.

Impact

New Codex sessions default to foundation workflows for grounding, planning, verification, review, release, incidents, security, and repository adoption. Missing or stale proof remains fail-closed as UNVERIFIED.

Validation

• Strict audit completed for all 15 packaged skills: no high or critical findings.
• Plugin version 0.1.0 is installed and enabled from the GitHub marketplace.
• codex-foundation CLI is installed as an isolated uv tool.
• Foundation doctor passes.
• 15/15 workflows qualify.
• Active and mirrored AGENTS.md files are byte-identical.
• Mirrored TOML parses and contains the expected Git marketplace and enabled plugin.
• A fresh Codex process discovered the foundation skill catalog.