ci(workflows): run chk_specs_skill_size in the structural-gates job

[bdfinst]

Intent Description

chk_specs_skill_size was added to scripts/ci-local.sh's CHECKS array in #2180 but is not named by any CI job's --only= list, so it runs only on a contributor machine via pre-push.

That is exactly the condition ci-local.sh's own comment block warns about:

Re-run that audit when adding an entry: an always-run check that no CI job names is a gate only a correctly-configured contributor machine enforces.

It is the same failure mode plugin-tests.yml:314-318 records for ruff ("scripts/verify_toolchain.py reached main carrying 20 ruff findings that way").

The gate exists to enforce epic #2159's SKILL.md size budget deterministically rather than by eye. It earned that during #2180 — it fired twice on slices that passed the per-slice cap but breached the cumulative ceiling. Leaving it CI-invisible means the next contributor to grow skills/specs/SKILL.md gets no signal unless their local hooks happen to be wired correctly.

Architecture Specification

One line, at .github/workflows/plugin-tests.yml:130 — append chk_specs_skill_size to the structural-gates job's list:

--only=chk_md_references,chk_skills_index,chk_rules_vs_prompts,chk_hook_units,chk_sa_mcp_tools,chk_specs_skill_size

The check needs only python3 and the checkout, which that job already has. It reads two files and exits non-zero on breach — no network, no build.

Then remove the interim note from scripts/ci-local.sh's exception comment block (added in #2180, marked explicitly as a gap rather than a deliberate exemption), since it no longer applies.

Why this wasn't done in #2180

The agent that added the check made this exact change and the push was rejected:

refusing to allow an OAuth App to create or update workflow
`.github/workflows/plugin-tests.yml` without `workflow` scope

Rather than leave the gap silent, the file was backed out and the gap documented in ci-local.sh and in a PR comment. This needs a token with workflow scope.

Current partial coverage

The cumulative ceiling half is incidentally covered in CI: tests/skills/test_specs_persistence_reference.py::test_skill_stays_below_the_pre_extraction_size re-asserts it, and tests/skills runs under chk_hook_units, which the structural-gates job does name.

The since-baseline delta half — the reason plugins/dev-team/skills/specs/.size-baseline.json is committed at all — runs nowhere in CI.

Acceptance Criteria

• chk_specs_skill_size appears in a CI job's --only= list and runs on every PR.
• The interim gap note is removed from scripts/ci-local.sh's exception comment block.
• The gate is confirmed to fail in CI on purpose once, per CLAUDE.md's "a gate that cannot fail is worse than no gate" — e.g. a scratch branch pushing skills/specs/SKILL.md past the ceiling.

Notes

Follow-up to #2180 (epic #2159). Referenced there in this comment.