Create Codex migration smoke-test suite for top GRC workflows

[ethanolivertroy]

Context

To avoid a cosmetic rename, the fork needs executable evidence that the toolkit works in the Codex app/harness. The source repo has package scripts and tests, but not a Codex-specific acceptance suite.

Current package.json includes scripts such as:

• gap-assessment
• scan-iac
• test-control
• map-control
• collect-evidence
• test:contract
• test:plugin-manifests

Tasks

• Define the top 5 user workflows to prove in Codex.
• Add fixtures that do not require paid cloud/SaaS credentials.
• Add a smoke-test command such as npm run test:codex-smoke.
• Validate Finding schema output for at least one workflow.
• Include negative tests for unsupported Claude-only plugin commands.
• Document exact commands Codex should run.

Acceptance Criteria

• A maintainer can run one command and see whether the Codex migration still works.
• The smoke test is wired into CI or explicitly documented as local/manual until stable.