Repository navigation

docs: inline spec 009 fields, drop private cross-reference #5

	name: CI

	on:
	push:
	branches: [main]
	pull_request:

	jobs:
	links:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- name: Lychee link check
	uses: lycheeverse/lychee-action@v2
	with:
	args: >-
	--no-progress

	--exclude-loopback
	--max-redirects 5
	--accept '200..=204,206,301..=308,403,429'
	'./*/.md'
	fail: true

	leak-guard:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- name: Scan for accidental leaks
	shell: bash
	run: \|
	set -e
	PATTERN='UNKNOWN @ file://\|/home/[a-z][a-z0-9_-]+/(orchestrator\|models)/\|sk-ant-api03-[A-Za-z0-9_-]{20,}\|sk-proj-[A-Za-z0-9_-]{20,}\|-----BEGIN (RSA \|EC \|OPENSSH \|DSA )?PRIVATE KEY-----'
	if git ls-files \| grep -vE '^\.github/workflows/' \| xargs -r grep -EHn "$PATTERN" 2>/dev/null; then
	echo "::error::Leak guard found suspicious patterns above"
	exit 1
	fi
	echo "Leak guard clean"