test(docs): prevent request-signing code drift

[bokelley]

Closes #6075

Follow-up design work: #6339

Summary

• derive request-signing error codes from the current branch conformance vectors
• validate concrete claims in the primary guide error-code section, including unprefixed table entries
• add a regression reproducing all seven phantom codes that triggered Docs restate machine-readable spec facts by hand, and nothing checks they agree — three live drift defects in one page #6075
• fail closed if the guarded section disappears and run the check in CI

Scope

The checker intentionally validates claims, not taxonomy completeness. Discovery/runtime codes live in the broader security taxonomy and are outside the graded vector-code section. Generated snippets and symbol autolinking are split to #6339 pending their Mintlify and description-authority decisions.

Validation

• npm run test:doc-compliance-drift (6/6)
• direct lint against the repository source contract
• changeset protocol-scope check: no protocol-scoped changes
• immutable release artifact tests
• independent expert review: approved, no findings

No changeset: CI/test-only guard with no protocol release surface changes.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated path requires human/CODEOWNERS review.

This PR modifies .github/workflows/build-check.yml, which matches the .github/workflows/** gated-path glob (gated_paths: true), and review_decision is REVIEW_REQUIRED — not APPROVED. Per decision-table row 2, the hard approval gate is not satisfied, so the outcome must be escalate.

The change itself looks clean: it adds a fail-closed lint (scripts/lint-doc-compliance-drift.cjs) that pins the request-signing guide's error-code claims to the request_signing negative conformance vectors, with a thorough test suite and CI wiring. No protocol surface is touched, so the absent changeset is correct. Only two low findings were surfaced (unguarded build-check step; section terminator matching # inside code fences), neither of which blocks.

Escalation reasons

• .github/workflows/build-check.yml (modified) matches gated path .github/workflows/**; requires human/CODEOWNERS approval (review_decision is REVIEW_REQUIRED, not APPROVED).

No blocking (critical/high) findings.

Why human review

• Modifies gated path .github/workflows/build-check.yml (matches .github/workflows/**); review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS review required.
• This PR touches a path under a hard, non-overridable approval gate (.github/workflows/build-check.yml (modified) matches .github/workflows/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated path requires human/CODEOWNERS review.

This PR modifies .github/workflows/build-check.yml, which matches the gated glob .github/workflows/** (gated_paths: true). The current review_decision is REVIEW_REQUIRED, not APPROVED, so the hard approval gate (decision rule row 2) is not satisfied and the PR cannot be auto-approved.

The change itself is clean: a test/CI-only PR adding a doc-compliance drift lint (scripts/lint-doc-compliance-drift.cjs) that keeps request-signing.mdx's concrete error-code claims aligned with the negative conformance vectors, plus its test (7/7) and package.json/build-check.yml wiring. Verified against the live repo — all 29 negative vectors carry valid request_signature_* codes, the guide's Error codes section holds only family wildcards the pattern correctly excludes, and the section fails closed if renamed/removed. No protocol/wire/dist surface touched, so no changeset is required. The reviewer surfaced no critical/high/medium findings.

Escalation reasons

• Modifies gated path .github/workflows/build-check.yml (matches .github/workflows/**); review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS review required before merge.

No blocking findings exist in the diff itself; the gate lifts automatically once a human/CODEOWNERS approval is recorded.

Why human review

• Modifies gated path .github/workflows/build-check.yml (matches .github/workflows/**); review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS review required.
• This PR touches a path under a hard, non-overridable approval gate (.github/workflows/build-check.yml (modified) matches .github/workflows/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.