feat: distribute fork-built scip so typeHierarchy works for end users

[phuongddx]

Why

typeHierarchy is broken for every end user: upstream scip (through
v0.9.0) never populates global_symbols.relationships in expt-convert
(scip#464), and the fix
(scip#465) is still
unmerged upstream. The fix IS merged in the public fork phuongddx/scip.
This PR distributes fork-built binaries to users via the existing zoekt
pattern — the private dev repo can't serve release assets anonymously, so
binaries are published to jarvis-intelligence/jarvis-index releases.

Plan: plans/0807-0948-patched-scip-distribution/plan.md

What changed

• SCIP_COMMIT (new): 12-char fork-commit pin, mirroring ZOEKT_COMMIT.
• build-scip.yml (new): on pin change or manual dispatch, clones the
  fork at the pin (a git clone, not go get — the fork keeps upstream's
  module path and a local replace directive), cross-compiles 4 platforms
  with CGO_ENABLED=0 GOWORK=off, smoke-tests (version must stamp the pin;
  expt-convert --help must work), and publishes tarballs + sha256
  sidecars to jarvis-index under tag scip-<pin> via JARVIS_DIST_TOKEN.
• setup.sh: downloads scip from the jarvis-index release instead of
  upstream. The install skip is version-gated, not presence-gated: an
  installed scip that doesn't stamp the pinned commit (i.e. every existing
  user's upstream v0.9.0) is reinstalled exactly once per pin bump. A
  warning fires if an older scip earlier on PATH would shadow the install.
• Error text + docs: the typeHierarchy error, plugin skills, README,
  AGENTS.md, and CLAUDE.md now state the remedy (re-run setup.sh, then
  jarvis reindex <slug>) instead of declaring the tool permanently
  broken — and the issues skill no longer tells users not to report it.
• Tests: pin↔file drift guard (with non-empty + hex-format assertions),
  release-repo invariants, and upgrade-path tests (pin-stamped binary
  skips; unpatched upstream binary falls through to reinstall).

Chicken-and-egg, handled

setup-smoke.yml runs setup.sh for real on PRs, so the release
scip-56791658a873
was published before this PR (locally cross-compiled at the pin, all 8
assets, anonymous download verified 200, binary stamps the pin with
clean: true). The post-merge push re-triggers build-scip.yml (the pin
file is new in that push), which rebuilds on CI and clobbers the same tag
— proving the workflow for future pin bumps.

Verified

• 79 setup.sh tests + full unit suite (442 passed) green; sh -n clean;
  no new shellcheck warnings; workflow YAML parses.
• End-to-end on this machine: install_scip via the modified setup.sh
  downloaded from the live release, sha256-verified, installed; binary
  reports SHA: 56791658… / clean: true.
• Reviewed (opus whole-branch review); all Important findings fixed in
  269dcb1 — chiefly the upgrade path for existing installs, which the
  original implementation would have stranded on the broken binary.

Exit ramp

When upstream merges #465 and cuts a release: repoint setup.sh's scip
download at scip-code/scip, delete build-scip.yml + SCIP_COMMIT.
Documented in setup.sh, the workflow header, and CLAUDE.md.

After merging

• Watch the auto-triggered build-scip.yml run rebuild/clobber the release.
• Next release's CHANGELOG must call out: re-run setup.sh + jarvis reindex <slug> to activate typeHierarchy (release also syncs the public
  setup.sh to jarvis-index).

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.