Align the CI workflow with `make ci` to eliminate drift

[dgenio]

Summary

Make .github/workflows/ci.yml execute the Makefile targets (make ci or its
constituent targets) instead of re-implementing each step inline, so the documented
local gate and the actual CI gate cannot diverge.

Why this matters

The drift is already real: the Makefile example target runs 9 example scripts, but
the CI "Examples" step runs only 5 — contextweaver_policy_flow.py,
repository_safety_check.py, chainweaver_flow.py, and
evaluation_artifact_policy.py are never executed in CI, so they can silently rot.
The repo's own docs (.claude/CLAUDE.md, AGENTS.md) tell agents "use make ci as
the single validation command"; CI should obey the same source of truth.

Current evidence

• Makefile lines 18–27: example runs 9 scripts; ci: fmt-check lint type test example.
• .github/workflows/ci.yml lines 45–49: only 5 example scripts listed; lint/format/type/test steps are re-implemented inline rather than invoking make targets.
• docs/agent-context/workflows.md names the Makefile as the authoritative command source.

External context

Not required for this issue.

Proposed implementation

1. Replace inline steps with make fmt-check lint type test example (split across
   steps for readable CI output, but each step a make target).
2. Keep matrix/python-setup/caching in the workflow; logic in the Makefile.
3. Add a comment in both files pointing at each other as the contract.
4. Verify the 4 currently-unrun examples actually pass in CI (they run in make ci
   locally, so they should), fixing any that need env guards.

AI-agent execution notes

• Inspect first: Makefile, .github/workflows/ci.yml, the 4 unrun examples (network use? http_driver_demo.py already runs in CI, so patterns exist).
• Edge case: examples needing no network must stay network-free; CI runners have no special env.
• Do not change what make ci itself does — that is the documented gate.

Acceptance criteria

• Every step in ci.yml that has a Makefile equivalent invokes the make target.
• All 9 examples run in CI.
• A deliberate local/CI divergence is no longer expressible without editing the Makefile.

Test plan

CI run on a PR; confirm all 9 examples execute and pass. Run make ci locally.

Documentation plan

Update docs/agent-context/workflows.md if step names change; CHANGELOG Changed (CI).

Migration and compatibility notes

Not expected to require migration.

Risks and tradeoffs

Make targets bundle steps, slightly coarsening CI failure granularity — splitting per
target preserves most of it.

Suggested labels

testing, reliability, contributor-experience