ci: split demo-gif render/commit workflow, extract quickstart

[jothimani-rajendran]

What this changes

Launch-prep block 1, items 1 and 2 (the two missing/incomplete workflows). Items 1
(hero-GIF compression) and item 5 (open-coder-ai-org grep, stale pyproject.toml
owner) from the handover are already true in this repo and untouched here — see
Notes below.

1. render-demo.yml → demo-gif.yml. workflow_dispatch is unchanged (renders
   docs/assets/demo.tape, uploads the demo-gif artifact, contents: read). A new
   push trigger — scoped to docs/assets/demo.tape, branches-ignore: [main] since
   main is protected with no bypass — renders and commits the regenerated
   docs/assets/demo.gif straight back onto the pushed branch via
   stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d
   (tag v7.2.0, resolved and verified with git ls-remote), contents: write on
   that job only, persist-credentials: true only there.
2. quickstart job moved out of ci.yml into .github/workflows/quickstart.yml
   (push + pull_request, ubuntu-latest, Python 3.12). tools/quickstart_block.py
   stays the single source of truth extracting the README's fenced block; the
   workflow additionally renders docs/quickstart.sh from that same extraction and
   fails on drift (diff -u), so there's a runnable script without a second place to
   edit it. The block still runs with bash -euo pipefail in a fresh mktemp -d.

Claim check

Not applicable — no adapter or matrix change.

Checks

• pytest -q passes — 1598 passed, 4 skipped
• ruff check . and ruff format --check . pass
• Runtime path is still stdlib-only (no new imports outside the standard library) — tests/check_stdlib_only.py passes
• Commits are signed off (git commit -s)
• actionlint v1.7.12 (built from source, not present in the base image) — clean on both new/changed workflow files
• Quick start block runs clean end-to-end locally (wires 12 agents, exit 0)

Notes for the reviewer

The /work scratch directory. docs/assets/demo.tape's hidden setup runs from
/work/demo with HOME=/work/user so agents that print resolved config paths (junie,
kimi_code) show a fixed, neutral path instead of a runner-specific scratch dir.
charmbracelet/vhs-action is a Node20 action (confirmed from its action.yml), not a
Docker action, so it runs directly on the runner's own filesystem — /work doesn't
exist there by default and the runner user can't mkdir under / without sudo. The
new render-and-commit job adds a step (sudo mkdir -p /work/demo /work/user && sudo chown -R "$(id -u):$(id -g)" /work) before the render step to create it with the right
ownership. I could not run this exact step on a real GitHub-hosted runner from this
session, so please watch the first real run of this trigger (e.g. by touching
docs/assets/demo.tape) to confirm it behaves as expected; workflow_dispatch is
untouched as the already-proven fallback path if it doesn't.

Proving the quickstart job fails on a broken block. Temporarily changed the
README's Quick start block's last line to agentseam install all "python3 my_handler.py" --events pre_tool --repo . --nonexistent-flag, then ran the same two
checks the workflow runs:

• the drift check (diff -u docs/quickstart.sh <regenerated>) → exits 1, shows the
  injected flag as the only diff
• the block itself (bash -euo pipefail quickstart.sh) → agentseam: error: unrecognized arguments: --nonexistent-flag, exit code 2

Reverted before committing; git status was clean afterward. Against the real README,
the same sequence wires 12 agents and exits 0.

Item 5 (grep for open-coder-ai-org, stale pyproject.toml owner). Re-verified
independently rather than taken on faith: grep -rn "open-coder-ai-org" . --exclude-dir=.git exits 1 (no matches), and pyproject.toml's [project.urls] already reads
open-coder-ai/agentseam throughout. No change needed or made.

Item 1 (GIF compression). docs/assets/demo.gif is 182,025 bytes — already well
under the 1.2MB target and explicitly named in the handover as one to leave alone. Left
untouched.

---

🤖 Generated with Claude Code