ci: enforce wix gateway proxy in all workflows

[dorraba]

What

Routes every npm-registry fetch in this repo's CI through the Wix npm embargo gateway — the same Shai-Hulud supply-chain protection already merged across the org (base44-dev/apper#19112, base44-dev/vite-plugin#105, base44/cli#592, …). All jobs run on ubuntu-latest, so the action, CA cert, and checker are ported byte-identical from vite-plugin/apper.

• .github/actions/wix-gateway-proxy (+ gateway CA cert): pins registry.npmjs.org to the gateway, trusts the gateway CA, exports NODE_EXTRA_CA_CERTS / DENO_TLS_CA_STORE.
• Injected as mandatory step 2 of all 8 jobs across 8 workflows. notify-slack-skill-sync.yml had no checkout (it only curls a Slack webhook) — it gets the minimal sparse-checkout: .github bootstrap. The sync workflows' second checkout (cli/sdk repo into a subdirectory) is unaffected: the proxy runs right after the skills-repo checkout.
• check-wix-proxy.yml + checker script + tests: CI fails if any job — present or future — skips the action. Verified locally: 8/8 jobs.
• wix-gateway-proxy-check.yml (manual dispatch) for connectivity debugging.

Why this repo

Five of the six workflows run anthropics/claude-code-action, which installs npm packages at job start (bun install of its bundled deps) and can run further npm installs from prompts; the readme-check and skill-sync agents also push commits and open PRs with elevated tokens. A poisoned npm dependency executing inside those jobs would hold contents: write + pull-requests: write. Same protection profile as the claude jobs in cli/vite-plugin.

Verification

• This PR's own CI (Claude Code Review, README Check if triggered) starts through the gateway
• Check Wix Gateway Proxy passes
• After merge: dispatch wix gateway proxy check once; next sync-cli-skill / sync-sdk-skill run confirms the agent flows
• After merge: consider making Wix Gateway Proxy a required status check

---

🤖 Generated with Claude Code