Phase 2: shared Verify profiles and isolated development SDK handoff

[VolkerChristian]

Phase 2 — Verify consolidation (control change first)

Shared build policy remains in SNodeC/.github; caller manifests contain build details, catalog contains identity. This replaces duplicated jobs, not a second parallel implementation.

Built

• Extend Verify with the existing three-platform AutoTalk Python/native qualification.
• Add tested SDK export and ordered @dev consumption with GitHub asset digest checks, safe extraction, repository/target/commit identity and dependency-revision validation; retain API-resolved @source for explicit source qualification.
• Run CTest unprivileged; retain exact PR-head checkout, runtime directories, IPv6, staged installs, and independent whitespace checks. Add changed-file formatting against existing policies and local Markdown-link checks.
• Narrow separate publish-dev.yml reusable publisher: default branch only, skips superseded runs, no product checkout/execution, unsigned dev prerelease/tag only. Approved write permission lives in product x-sdk, not the seven-line read-only Verify caller.
• Extend commented manifest and document preservation/rollout in PHASE2.md.

Verified

• Control GitHub CI: green; 31 unit/boundary tests, catalog check, generated profile drift.
• Local GCC 15.3.0/trixie: snode.c 212/212, mqttsuite 6/6 new CLI/MQTT smoke tests, AISuite 22/22 plus pinned protocol generation.
• Real SDK relocation in a separate container (producer paths absent): SNode.C installed consumer runs; CodexUI builds against extracted snode.c/AISuite SDKs.
• actionlint 1.7.12, changed C++/CMake formatting and whitespace checks pass.
• CodexUI web job preserved structurally, except replacing hard-coded AISuite branch checkout with default-branch checkout. Existing baseline CI already has native failure/web success. Full local Xvfb/offscreen qualification: 84 cases, 16 failures, four existing Breeze skips. Root baseline reproduces the semantic-no-op failure. No UI tests/gates weakened.
• AutoTalk native Linux package builds and packaged smoke launch passes locally; full native matrix is still pending. Headless playback qualification hangs; the maintainer explicitly deferred CodexUI/AutoTalk test fixes. Tests remain enabled; investigation is stopped.

Local commands

python -m pip install -r requirements.txt
# Also install CMake, Ninja, Git, g++, zstd and tar.
python tools/snodec_sync check
python -m unittest discover -s tests -v
python tools/snodec_sync profile --output /tmp/profile.md
diff -u profile/README.md /tmp/profile.md

Required merge order / NOT complete yet

1. Merge this control PR; maintainer publishes a reviewed workflow version and moving v1 in SNodeC/.github. Currently only v1.0 exists; it is not @v1 and does not contain these extensions. No version tag is created by this task.
2. snode.c caller → green default-branch CI and dev SDK.
3. mqttsuite/AISuite callers → green tests/protocol and SDK publication.
4. CodexUI after both SDK prerequisites; AutoTalk after the shared workflow release. Their existing test defects are explicitly deferred, not disabled or claimed fixed.

Phase 2 gate remains snode.c and mqttsuite green on their actual default branches. Draft caller PRs must not merge before prerequisites exist. Stable tags, secrets, licences, product READMEs, forks and package workflows/pipeline are unchanged. README alignment remains Phase 4.

Accounting (coordinated change, excluding docs/manifests)

Production orchestration/build integration: +393 / −314 lines, net +79. Tests/test integration: +444 / −17, net +427. Growth is the explicitly approved missing Python/SDK capability; redundant native/dependency jobs are deleted. No product runtime implementation is changed.

Caller drafts: snode.c #266, mqttsuite #31, AISuite #60, CodexUI #76, AutoTalk #6.