fix(OMN-16697): restore the OCC manual-replay precheck + gate workflow script refs

[jonahgabriel]

OMN-16697 — the OCC manual-replay entrypoint is a dead end in this repo

Parent: OMN-16664. Split per-repo because OMN-16664 already carries a merged OCC
companion (onex_change_control#7242, for omnimemory#449); a second PR citing it
would re-mint into the same contracts/OMN-16664.yaml cohort, which is the
collision that closed OCC#7240 CONFLICTING on 2026-08-27.

Observed

.github/workflows/call-occ-autobind.yml and call-occ-companion-effect.yml
each run:

run: python3 scripts/ci/occ_manual_replay_precheck.py pr_state.json

scripts/ci/occ_manual_replay_precheck.py does not exist anywhere in this
repo's dev. Live shape from the sibling repos where it was dispatched:

python3: can't open file '/home/runner/work/.../occ_manual_replay_precheck.py'
[Errno 2] No such file or directory

(omnibase_compat run 33001337186; omnimemory run 33019346585.)

It fails CLOSED — the publish step never runs, so nothing bad reaches the bus —
but the only sanctioned recovery path when the OCC born path misses a mint has
been unavailable in this repo since the OMN-15017 fan-out, which copied the
workflow files without carrying the script they call.

Change 1 — the script (AC1)

Ported from omniclaude@dev scripts/ci/occ_manual_replay_precheck.py
(blob 3d53ed9, sha256 0a9899f5f9c44785...).

Provenance, since four divergent copies exist across the org and the parent
ticket asks which is canonical:

repo	origin	shape
omnibase_infra	OMN-14993, #2411 (2026-07-24)	the original
omniclaude	OMN-15393, #1962 (2026-07-29)	original + ManualReplayInputError: a malformed or truncated pr_state.json exits 2 instead of reading as OPEN-and-non-draft and publishing
omniweb	#307 (2026-08-20)	original with the rationale docstring stripped
omnimemory	OMN-16665 (2026-08-27)	original + --allow-merged-replay

omniclaude's is the port source: it descends from the OMN-14993 original, is a
strict superset on the fail-closed axis, and takes the same single positional
argument this repo's workflows pass. omnimemory's --allow-merged-replay is
deliberately not carried — the workflows here expose no such input, so its
refusal text would tell an operator to set a flag that does not exist.

Change 2 — the standing guard (AC4)

A gate, not a one-time fan-out. tests/ci/test_workflow_script_refs_exist.py
statically asserts that every scripts/** path a run: step executes from
the repository root exists in the tree, wired on both surfaces in this same
PR (Operating Rule #5):

• CI — .github/workflows/workflow-script-refs.yml, job
  Workflow Script Reference Gate. Unconditional: no paths: filter and no
  if:, so it is eligible to be added to required_status_checks on dev.
• pre-commit — hook workflow-script-refs, on
  ^(\.github/workflows/.*\.ya?ml|scripts/.*)$.

Two blind spots are deliberate, unit-tested, and printed on every run rather
than left silent:

• a step with a non-root working-directory (the OCC publish step runs
  scripts/publish_occ_autobind_command.py inside the .occ-autobind-src
  checkout of omnimarket — a claim about omnimarket's tree, not this one);
• every step after an actions/checkout that names a repository: and lands at
  the workspace root (cr-thread-gate.yml checks omniclaude out at root and then
  runs scripts/check-unresolved-threads.sh, which is omniclaude's file). This
  case was found because the first draft of the gate flagged it as a violation;
  the extractor was corrected rather than the finding suppressed.

The extractor is unit-tested against synthetic workflows with known answers,
positive and negative, and a vacuity test fails if the real tree yields zero
references — a silently-non-matching extractor would otherwise pass every
existence assertion forever, the same shape as the bug it guards against.

Local proof (RED, then GREEN)

# with scripts/ci/occ_manual_replay_precheck.py removed:
FAILED tests/ci/test_workflow_script_refs_exist.py::test_every_workflow_referenced_local_script_exists
  - call-occ-autobind.yml (job occ-autobind-manual-replay) runs scripts/ci/occ_manual_replay_precheck.py
  - call-occ-companion-effect.yml (job occ-companion-effect-manual-replay) runs scripts/ci/occ_manual_replay_precheck.py
# restored:
12 passed

The pre-commit hook was exercised the same way and refused in the same
direction. pre-commit run --all-files green.

The copy is byte-identical to the omniclaude source (sha256 match verified after
this repo's own ruff and SPDX hooks ran).

dod_evidence

• This PR.
• The RED/GREEN transcript above — the guard fails on exactly the OMN-16664
  defect and passes once the script is present.
• AC3 (a real workflow_dispatch replay reaching the precheck and deciding,
  rather than dying on a missing file) is executed against this repo after this
  PR lands; the run link is recorded on OMN-16697 and on OMN-16664.

Evidence-Ticket: OMN-16697
Evidence-Source: OCC#7250

[coderabbitai]

Warning

Review limit reached

Next included review available in 51 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 126 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2790c9ff-8ff1-4013-8613-385b6c8bde56

📥 Commits

Reviewing files that changed from the base of the PR and between 728a991 and b2bf264.

📒 Files selected for processing (4)

• .github/workflows/workflow-script-refs.yml
• .pre-commit-config.yaml
• scripts/ci/occ_manual_replay_precheck.py
• tests/ci/test_workflow_script_refs_exist.py

---

_{Comment @coderabbitai help to get the list of available commands.}