Require drift audit before maintenance no-op

[chubes4]

Summary

• require the generic technical maintenance package to audit in-scope documentation claims against relevant repository source before classifying a run as no_changes
• cover configuration and workflow behavior, immutable revisions and provenance, commands, tests, examples, and operational contracts
• preserve clean audited no-ops while requiring the smallest reviewable in-scope documentation correction for material drift
• assert the contract deterministically and advance the immutable package revision/digest fixtures

Closes #160.

Source relationship and scope

The native technical-docs-maintenance-agent.agent.json package is the repository's sole executable instruction authority for this lane; the retired manifest/flow/pipeline source family and generator are not present in the current architecture. This is an instruction-only package contract change plus deterministic validation and provenance fixtures. It does not change runtime code, tool policy, writable paths, publication behavior, bootstrap agents, user-doc agents, or the skills agent. The runtime impact is therefore no broader than the source evidence in #160: maintenance no-op classification now requires the bounded audit that the failing runs lacked.

Verification capability is deterministic at three boundaries: required instruction phrases, historical package bytes/digest/provenance, and real Agents API import plus the pinned WP Codebox reusable-workflow contract.

Stranger-runnable tests

1. Validate native package shape, the drift-audit instruction contract, and runner recipes: php tests/validate-docs-agent-packages.php
2. Validate the immutable package revision, byte digests, canonical slugs, and workflow lane mappings: php tests/validate-external-native-package-sources.php
3. Smoke-test documentation link repair: php tests/repair-docs-links-smoke.php
4. Check out Agents API at 78e2dd409010f98fa4d26cdd72572117384ab18d, then run: AGENTS_API_DIR=/path/to/agents-api php tests/native-agent-import.php
5. Check out WP Codebox at 65cc5fb4699cb7c2df13d04b4715c97097ac7565, then run: WP_CODEBOX_DIR=/path/to/wp-codebox php tests/validate-wp-codebox-run-agent-task-contract.php
6. Validate workflow syntax: actionlint .github/workflows/*.yml
7. Validate patch whitespace: git diff --check 53f43bc6433d2631750edabcb458a77db55aa8cb..HEAD

All tests passed locally.

Compatibility impact

No schema, runtime API, package slug, enabled tool, write gate, writable-path, or publication contract changes. Existing clean maintenance no-ops remain valid after audited claims match source. Only the technical maintenance package bytes and their required immutable digest/provenance declarations change.

AI assistance

Implemented and verified with AI assistance from openai/gpt-5.6-sol.