verify(P8): workflow-generator-dedup — 4-layer verify PASS + ship

VERIFY: structural — generator + sources; behavioral — 98 tests + CI PASS; quality — ~20KB dedup, single source of truth.

---ci---
project: acdl
phase: 8
milestone: v1.16
status: complete
phase_role: execution
requirements:
  covered: [REQ-172]
  partial: []
---/ci---

tests/test_pipeline_contract.py

@@ -101,10 +101,25 @@ class TestWorkflowConformance:
         assert (ROOT / ".github/workflows/ci.yml").is_file()
 
     def test_workflows_are_byte_identical(self):
+        # P8 (REQ-172): the byte-identity is now enforced by
+        # scripts/sync_workflows.py --check (generated from workflows-src/).
+        # The two dirs must still be byte-identical (the generator writes
+        # the same source to both); this assertion is the belt, the
+        # generator --check is the suspenders.
         gitea = open(ROOT / ".gitea/workflows/ci.yml", "rb").read()
         github = open(ROOT / ".github/workflows/ci.yml", "rb").read()
         assert gitea == github, "Gitea and GitHub workflows must be byte-identical"
 
+    def test_sync_workflows_check_passes(self):
+        """P8 (REQ-172): sync_workflows.py --check exits 0 (committed
+        files match the workflows-src/ sources)."""
+        import subprocess
+        rc = subprocess.call(
+            [sys.executable, "scripts/sync_workflows.py", "--check"],
+            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+        )
+        assert rc == 0, "sync_workflows.py --check failed — run scripts/sync_workflows.py --write"
+
     def test_gitea_workflow_name_matches_contract(self):
         wf = _load_workflow(".gitea/workflows/ci.yml")
         contract = _load_yaml("pipelines/ci.yml")