ci: add claudecode-compatibility job + gated publish-claude workflow

ci.yml claudecode-compatibility (3-OS, runs test:claude) wired into build.needs.
publish-claude.yml: workflow_dispatch-only, identity guard, missing-secret hard-fail
(off by default), syncs to lazyclaudecode, bumps 3 omo-claude version locations.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -139,9 +139,41 @@ jobs:
       - name: Run Codex compatibility tests
         run: bun run test:codex
 
+  claudecode-compatibility:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.12"
+
+      - uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-1.3.12-${{ hashFiles('bun.lock') }}
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+        env:
+          BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/cli @ast-grep/napi"
+
+      - name: Run Claude Code compatibility tests
+        run: bun run test:claude
+
   build:
     runs-on: ubuntu-latest
-    needs: [test, typecheck, codex-compatibility]
+    needs: [test, typecheck, codex-compatibility, claudecode-compatibility]
     permissions:
       contents: write
     steps: