fix(code): make guided-manual-qa the single copy for Codex and Claude Code (ISS-11436)

[shafty023]

Why

guided-manual-qa existed in two places: plugins/code/skills/guided-manual-qa here (added in #205, ISS-11436) and a local Codex skills copy it was ported from. The two drifted. The Codex copy picked up session continuity and checkpoint rules after the port, while this copy gained the tested TypeScript launcher and wording cleanups.

This PR makes the plugin directory the single canonical copy, used by both Claude Code (through the installed code plugin) and Codex (which will load this directory through a symlink). Everything the Codex copy had that this one lacked is folded in, and the skill no longer depends on anything only one harness understands.

What changed

Brought over from the Codex copy:

• Session continuity. When a QA session spans tool calls or worker turns, services run under a repository-supported or OS-supported owner that survives that boundary, and the record says how to inspect and stop it. A resumed session rereads the QA record and rechecks the head, owned processes, listeners, data target and route; earlier PIDs and ready checks are historical evidence only.
• Checkpoint steps. Before a UI checkpoint the agent opens the requested window or app itself, verifies the settled origin and a visible control owned by the route, and keeps it available. An unready window keeps the checkpoint pending as a setup limitation. After presenting a checkpoint the agent stops tool calls until the human responds or asks for setup help.
• QA record template. New line for the interactive window or app owner, settled route and control, and last live verification time; a note under the services table to record each process owner and recheck the rows after a resume.
• agents/openai.yaml so Codex keeps its display name, short description and default prompt. claude plugin validate plugins/code output is identical before and after adding it, and claude plugin validate plugins/code/skills passes.

Kept from this copy:

• The tested scripts/dist/launch-interactive-browser.mjs launcher. The Codex .cjs launcher is not brought over.
• The harness-neutral QA record location and the removed em dashes.

Made portable:

• SKILL.md no longer uses ${CLAUDE_SKILL_DIR}, which Codex does not expand. It names the launcher as scripts/dist/launch-interactive-browser.mjs relative to the skill directory and tells the agent to resolve the absolute path from where it read SKILL.md, while running it from the repository root so Playwright still resolves from the repository under test. references/browser-state-fixtures.md uses the same placeholder.

No merge conflicts: the Codex-side changes and this copy's changes touch different lines.

Versions

• code 1.15.0 -> 1.15.1 (skill wording, template lines, Codex metadata file)

Testing

• uv run ruff check .: clean
• uv run pyright: 0 errors
• uv run pytest plugins/: 2175 passed, 3 skipped
• tools/guided-manual-qa: npm run typecheck, npm test (40 passed), npm run build (committed bundle unchanged)
• node plugins/code/skills/guided-manual-qa/scripts/dist/launch-interactive-browser.mjs --help prints usage
• claude plugin validate plugins/code: passes, same warnings as main