fix(ci): skip context:sync's drift check under CI, matching dma-cli/gitea-mcp

hyperguild's Taskfile ran context:sync unconditionally in 'check', with no
guard for the CI runner having no ancestor .context/AGENT.md. That made it
silently regenerate AGENTS.md and .context/system-prompt.txt from project
context alone (82 lines vs. the committed, correct 430) and then fail its
own drift assertion against that wrong baseline every run -- a false
positive, not real drift. Verified locally: syncing with the real root
context reproduces the committed 430-line files byte for byte; syncing
without it (as CI does) produces the shorter fallback that triggered this.

Same guard dma-cli and gitea-mcp already carry, same rationale: drift is
now caught either on a developer machine or by infra's estate-wide
context-sync-drift CronJob (ADR-0019), which does have canonical access.

Taskfile.yml

@@ -86,18 +86,37 @@ tasks:
   check:
     desc: Run all checks (context freshness + lint + test + vet) across all modules
     cmds:
-      - task: context:sync
+      # Context sync is skipped under CI, matching dma-cli, gitea-mcp, and the
+      # rest of the estate. It is not a preference: context-sync.sh walks UP
+      # the tree for the canonical .context/AGENT.md, which lives in local-dev
+      # and does not exist on a CI runner. Without this guard, the script
+      # silently falls back to "project context only" and regenerates AGENTS.md
+      # and .context/system-prompt.txt shorter than their committed, correct
+      # versions -- so the drift assertion fails every CI run for a purely
+      # environmental reason, not real drift. Verified, not assumed: this is
+      # exactly what was happening here (AGENTS.md 430 lines committed vs. an
+      # 82-line regeneration on the runner).
+      #
+      # The cost is real and worth stating: drift is therefore only ever caught
+      # on a developer machine, or by infra's estate-wide context-sync-drift
+      # CronJob (ADR-0019), which does have canonical access and is the actual
+      # enforcement mechanism now.
       - cmd: |
-          drift=$(git status --porcelain -- AGENTS.md CLAUDE.md .context/system-prompt.txt 2>/dev/null)
-          if [ -n "$drift" ]; then
-            echo "ERROR: derived adapters drifted from canonical context." >&2
-            echo "$drift" >&2
-            echo "" >&2
-            echo "Run: git add AGENTS.md CLAUDE.md .context/system-prompt.txt" >&2
-            echo "     git commit -m 'chore: re-sync context adapters'" >&2
-            exit 1
+          if [ -n "${CI:-}" ]; then
+            echo "✓ context sync: skipped in CI (no canonical AGENT.md on the runner)"
+          else
+            bash scripts/context-sync.sh
+            drift=$(git status --porcelain -- AGENTS.md CLAUDE.md .context/system-prompt.txt 2>/dev/null)
+            if [ -n "$drift" ]; then
+              echo "ERROR: derived adapters drifted from canonical context." >&2
+              echo "$drift" >&2
+              echo "" >&2
+              echo "Run: git add AGENTS.md CLAUDE.md .context/system-prompt.txt" >&2
+              echo "     git commit -m 'chore: re-sync context adapters'" >&2
+              exit 1
+            fi
+            echo "✓ context: canonical and adapters are in sync"
           fi
-          echo "✓ context: canonical and adapters are in sync"
       - task: lint
       - task: test
       - task: vet