CI: run the generator and assert its output matches what is committed

[emmanuelgjr]

Why

generate.js sat broken on main for several commits (fixed in #28) and nothing caught it — because no job ran it. The Content Validation workflow runs validate.js and stats:check, neither of which loads the generator. A file that produces every entry in data/entries/ and both webapp data bundles had no CI coverage at all.

What

A Generator reproducibility job that runs node scripts/generate.js and then asserts:

git diff --exit-code -- data/entries docs/data.js docs/incidents.js

That catches three failures the existing jobs cannot:

1. the generator failing to load or throw at all (the Fix: generate.js failed to run — AST catalogue block inserted three times #28 case);
2. a hand-edit to a generated file, which would be silently overwritten on the next run;
3. a source change that was never regenerated, so data/entries/ and the webapp disagree with the Markdown.

Also

The path filters still listed three source directories. Nothing under ast-top10/ triggered validation, and a change to scripts/generate.js itself triggered nothing. Both are added.

Verification

Run locally against the current tree: generator runs clean, git diff --exit-code over those paths is empty — the guard passes on main as it stands, so it gates future drift rather than flagging existing state.

🤖 Generated with Claude Code