check for large binaries in CI

.github/binary-blob-allowlist.txt

@@ -0,0 +1,4 @@
+# Paths are matched exactly, relative to the repository root.
+# Keep this list short and limited to intentional large binary assets.
+
+.github/codex-cli-splash.png

.github/workflows/binary-blob-policy.yml

@@ -0,0 +1,29 @@
+name: binary-blob-policy
+
+on:
+  pull_request: {}
+
+jobs:
+  check:
+    name: Binary blob size policy
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Determine PR comparison range
+        id: range
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "base=$(git rev-parse HEAD^1)" >> "$GITHUB_OUTPUT"
+          echo "head=$(git rev-parse HEAD^2)" >> "$GITHUB_OUTPUT"
+
+      - name: Check changed binary blob sizes
+        run: |
+          python3 scripts/check_binary_blob_size.py \
+            --base "${{ steps.range.outputs.base }}" \
+            --head "${{ steps.range.outputs.head }}" \
+            --max-bytes 512000 \
+            --allowlist .github/binary-blob-allowlist.txt