feat(M3): Shared-source generator for agent variants

scripts/verify-pi-workflows.sh

@@ -13,6 +13,7 @@ WORKFLOW_FILES=(
 for file in "${WORKFLOW_FILES[@]}"; do
   test -f "$file"
   grep -q 'docs/PI-SUPERPOWERS.md' "$file"
+  # shellcheck disable=SC2016
   grep -q 'Reviewer CLI: `codex`, `claude`, `cursor`, `opencode`, `pi`, or `skip`' "$file"
   grep -q 'pi --no-session --no-skills --no-prompt-templates --no-extensions --no-context-files' "$file"
   grep -q -- '--tools read,grep,find,ls -p' "$file"
@@ -21,6 +22,7 @@ done
 
 grep -q 'reviewer model is configured independently' docs/PI-COMMON-REVIEWER.md
 grep -q 'provider-qualified model IDs' docs/PI-COMMON-REVIEWER.md
+# shellcheck disable=SC2016
 grep -q 'MUST NOT include `write`, `edit`, or `bash`' docs/PI-COMMON-REVIEWER.md
 
 if command -v pi >/dev/null 2>&1; then
@@ -43,6 +45,10 @@ grep -q 'Reviewer CLI | codex \\| claude \\| cursor \\| opencode \\| pi' skills/
 test -x skills/reviewer-runtime/pi/run-review.sh
 test -x skills/reviewer-runtime/pi/notify-telegram.sh
 
-! rg -n 'update_plan|plan mode|sub-agent|subagents' "${WORKFLOW_FILES[@]}"
+# SC2251: restructured to avoid ! outside condition
+if rg -n 'update_plan|plan mode|sub-agent|subagents' "${WORKFLOW_FILES[@]}"; then
+  echo "Error: pi workflow SKILL.md files must not contain Codex-specific terms" >&2
+  exit 1
+fi
 
 echo "pi workflow skill docs verified"