test(parity): add OpenAI Tier 2 backend + SkillInvocationBackend Protocol (Fixes #368) [stacked on #370] - #371

Kusari Analysis Results:

✅ No Flagged Issues Detected
All values appear to be within acceptable risk parameters.

Both dependency and code analyses independently recommend proceeding, and their combined findings do not elevate the overall risk profile. On the dependency side, the two introduced packages — openai@2.53.0 (direct, Apache-2.0) and tqdm@4.70.0 (transitive, MIT AND MPL-2.0) — carry no vulnerabilities, no blocked packages, and no security advisories. The only minor note is that openai@2.53.0 is not the registry default (latest is 3.0.0), which is a low-risk pinning concern only. On the code side, the single medium-severity, low-confidence finding (artipacked) notes that actions/checkout does not set persist-credentials: false, allowing the GITHUB_TOKEN to persist in .git/config. This risk is substantially mitigated by: (1) workflow_dispatch-only triggering with no untrusted external actor access, (2) execution gated behind a named environment (parity-tier2-openai) requiring authorized reviewer approval, (3) contents: read-only permissions at both workflow and job level, and (4) no subsequent steps performing git operations that would exploit persisted credentials. This represents a defense-in-depth gap rather than an exploitable vulnerability. As a hardening improvement, adding persist-credentials: false to the checkout step is recommended for a future cleanup but does not warrant holding this PR.

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: db4a8c3, performed at: 2026-08-14T00:26:24Z