docs: establish canonical public content pipeline

[BartWaardenburg]

Summary

• define this repository as the sole authored source for public user documentation
• publish a deterministic, provenance-carrying content archive for trusted consumers
• fail CI on manifest drift, broken links, invalid docs, private paths, symlinks, local paths, and high-confidence credentials
• pin the documentation toolchain and add ownership for content and publication tooling

Verification

• npm run check
• npm run content:archive produces byte-identical archives for identical content and commits
• actionlint .github/workflows/docs.yml
• git diff --check

Follow-up

The private Fallow Cloud site will consume a pinned revision of this public artifact. Cloud-only rendering and private documentation remain in the private repository.