ci: gate shared-contract drift (PluginKit + DatabaseType)

[datlechin]

Summary

Adds a fast CI gate that fails when a shared contract diverges beyond a known baseline, so the existing duplication can't get worse while Phase 1 consolidation is pending. No source is moved.

• scripts/audit-refactor-health.sh --check now compares the live drift against .github/duplicate-contract-baseline.txt and fails only on new divergence:
  • a TableProPluginKit file that differs or exists in only one of Plugins/TableProPluginKit vs Packages/TableProCore/Sources/TableProPluginKit
  • a production DatabaseType definition outside the authoritative TableProCore source
• .github/duplicate-contract-baseline.txt records today's known drift (48 PluginKit files + the desktop DatabaseType). Burn it down as contracts move into TableProCore; never add a fresh entry to make new drift pass.
• .github/workflows/contract-drift.yml runs the check on ubuntu (pure bash/grep, no Xcode) for PRs and pushes touching the relevant paths.

This implements the drift-check step (PR-sequence #6) ahead of the higher-risk PluginKit/model consolidation (#7/#8), now that the macOS CI gate from #1481 exists.

Risk Addressed

• R-001: Duplicate PluginKit contracts can silently diverge.
• R-002: Duplicate DatabaseType definitions can disagree across targets.

Verification

• scripts/audit-refactor-health.sh --check passes on main (live drift == baseline).
• Fails when a new divergent PluginKit file is introduced.
• Fails when a DatabaseType definition appears outside the authoritative source + baseline.
• Passes again once the injected drift is removed.

Notes

• ABI bump required: no.
• Docs updated: no.
• No Swift source changed; nothing moved between trees.
• Suggest marking the Shared contract drift check as required in branch protection so new drift blocks merge.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: babc5f4690

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Run drift check for all scanned DatabaseType paths

The audit script scans all of TablePro, Plugins, Packages, and TableProMobile for extra DatabaseType definitions, but this workflow only runs when a narrow subset of those paths changes. For example, a PR that adds struct DatabaseType under TablePro/Core or another package/plugin path outside these filters will not trigger contract-drift.yml, so the new duplicate contract can merge without the new gate ever running. Broaden the path filters to cover every directory scanned by databasetype_extra_defs or remove the filter for this workflow.

Useful? React with 👍 / 👎.