docs(8/10): consolidate validation CI security and invariants

[flyingrobots]

Decision

Give operators one truthful route for local validation, CI, security tooling, repository invariants, and generated-artifact hygiene.

This is documentation reconstruction slice 8 of 10.

Scope

Rewrite current, executable guidance into:

• docs/topics/validation.md
• docs/topics/ci-workflows.md
• docs/topics/security-tooling.md
• docs/topics/invariants.md
• docs/topics/artifacts-and-cache.md
• docs/topics/docs-maintenance.md

Extract verified rules from and then delete duplicate reader-facing material under:

• docs/invariants/
• docs/ci.md
• docs/scripts-reference.md
• standalone security/tooling pages outside the topic tree
• obsolete audit summaries that are incorrectly used as current operational guidance

Every documented command must be runnable and every named check must match actual cargo xtask, package, Bats, or workflow behavior. Describe retained JavaScript automation only where it has a real current owner; do not call deleted packages “core,” “CLI,” or “generators.”

Update hard-coded documentation paths in affected workflows and Bats suites in the same slice.

RED

Add focused fixtures for the known false-green classes: nonexistent pnpm filters that exit zero, undocumented/misnamed xtask checks, stale workflow names, missing paths, and invalid anchors.

Acceptance

• Operators have one local-check matrix and one CI interpretation route.
• Invariant pages state enforced properties and point to the enforcing code/test, not historical intent.
• No command succeeds merely because pnpm matched zero packages.
• Duplicate source pages are deleted rather than archived.
• Relevant workflow tests, Bats suites, docs-check, preflight, and git diff --check pass.

Scheduling

• Ordered after docs(7/10): collapse process and release governance into topics #749.
• Blocked by refactor(governance): replace goalposts with version milestones #742.
• The v0.3.0 label is temporary until the plain version-milestone cutover.

[coderabbitai]

🔗 Related PRs

#657 - docs(release): adapt lifecycle runbook [merged]
#686 - docs: add plain Wesley onboarding path [merged]
#687 - docs: publish assurance capability matrix [merged]
#692 - docs: add first contributor fast paths [merged]
#741 - Add IR-to-Brainfuck extension generator example [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!