Closes the gap left after #70/PR #81: the agent-jail package set is hand-synced
across two repos (this bootstrap's PKGS= and clawdie-iso pkg-list-jails.txt
"# agent-jail" section) with nothing catching future drift.
- check-agent-jail-pkgs.sh: pure POSIX sh; extracts PKGS= here, fetches the
clawdie-iso list over HTTP (ISO_PKG_LIST_URL overridable), diffs the two sets,
reports the delta, exits non-zero on mismatch.
- ci.yml: new `agent-jail-pkgs` job runs it on every push/PR.
Same shape as the CARGO_CRATES drift check. Verified: green in sync (5 pkgs);
negative test flags missing packages and exits 1; ci.yml valid YAML.
Single-sided (fires on colibri CI); the clawdie-iso list is fetched from main.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
