Verify self-updating engine under the GitHub Actions runner (residual from #26)

[vedantggwp]

Context

Follow-up carved out of #26. That issue's headline blocker — the self-updating engine had never been live-run and had never produced a real PR on a public living grimoire — was resolved on 2026-07-12: a full /grimoire:update ran end-to-end and opened context-engineering-grimoire#1 (2 sources ingested, 2 articles, 5 connections, site regenerated).

But that run executed via the local scheduled-task runner, driving the dist/ bundles by absolute path (node /Users/ved/Developer/grimoire/dist/compile.js). It proved the engine logic, not the GitHub Actions environment. This issue tracks the narrower remaining gap: proving the same pipeline under .github/workflows/grimoire-update.yml on ubuntu-latest via anthropics/claude-code-action@v1.

What's still unverified (Actions runner only)

• Plugin auto-load in headless CI — the workflow relies on .claude/settings.json declaring the Athanor marketplace + grimoire@athanor so the headless run auto-loads the plugin. Never confirmed to actually load under claude-code-action.
• ${CLAUDE_PLUGIN_ROOT} resolution under Actions — the skill invokes node ${CLAUDE_PLUGIN_ROOT}/dist/{compile,research,present}.js. The local run used an absolute path; under CI this env var must resolve to the auto-loaded plugin's install dir, and the dist/ bundles must be present there. Highest-risk unknown.
• WebSearch under the Actions runner — delta-scout discovery used WebSearch locally. Availability/behavior under claude-code-action on ubuntu-latest is unconfirmed (the skill's documented fallback is watchlist-URL fetching when WebSearch is absent — that degradation path is also untested in CI).
• Provider fetch ladder under Actions — research.js fetch (verbatim-first) worked locally at extract fidelity for arXiv. Needs to run from the CI network egress (arXiv/GitHub reachable, no proxy/allowlist surprises).
• gh pr create with github.token — branch push + PR open under least-privilege contents: write / pull-requests: write. (Note the workflow's own caveat: PRs opened with the default GITHUB_TOKEN won't trigger on: pull_request CI — recursion guard.)

How to verify

1. Add the CLAUDE_CODE_OAUTH_TOKEN Actions secret (claude setup-token) to context-engineering-grimoire.
2. Settings → Actions → General → enable "Allow GitHub Actions to create and approve pull requests".
3. Actions tab → Grimoire Update → Run workflow (workflow_dispatch) — don't wait for the Monday cron.
4. Expected: a no-op or a small PR (cross-run dedup makes a same-week rerun near-empty — context-engineering-grimoire#1 already ingested ACE/ACON, so a rerun should mostly dedup). Either outcome proves the path.
5. Capture the job log as the closing evidence here.

Definition of done

One green workflow_dispatch run of grimoire-update.yml that loads the plugin, resolves ${CLAUDE_PLUGIN_ROOT}/dist, runs scout→ingest→compile→present, and either opens a PR or logs a clean no-op — with the job-summary digest attached.

Filed as the residual follow-up to #26 after the first successful local scheduled run.