[docs] Add docs drift checks for generated docs, llms files, and API surface

[serge-ivo]

Problem

Docs drift is currently easy to introduce: generated docs, llms.txt, llms-full.txt, OpenAPI, package READMEs, and source docs can contradict implementation without a check failing.

Recent audit examples:

• Runtime docs disagree on relay-only vs tunnel fallback.
• Job Application Assistant README describes old job.apply_basic task flow.
• OpenAPI misses many live Hono routes.
• Coder docs say runner-node UI is future work even though it exists.
• README catalog count does not match checked-in manifests/registry.

Scope

Add lightweight validation so future changes catch the highest-risk drift:

• Route inventory check comparing implemented Hono routes to OpenAPI coverage, with an allowlist for intentionally undocumented/admin routes.
• Text assertions that current runtime docs do not mention removed current-path commands such as pags up --tunnel or FAGS.
• Check that platform-docs/*.md and generated platform/store/docs/** are in sync after pnpm docs:build.
• Optional catalog consistency check across README, agents/*/agent.json, migration seeds, and store/registry.json once the source of truth is decided.

Acceptance Criteria

• CI or pnpm test/pnpm docs:build can detect the main docs drift classes above.
• The check has a small intentional allowlist, not a brittle giant snapshot.
• CONTRIBUTING or README documents how to update docs artifacts when route/docs sources change.

[serge-ivo]

Shipped in 1640f25 — closing, left open by the delivering agent.

scripts/docs-drift.mjs (pnpm docs:drift), CI-wired, delegating the API half to the existing openapi-coverage.mjs rather than duplicating it. Checks nav ↔ sources, removed commands in runnable code blocks only (prose may discuss --tunnel; a code block may not), MCP tool table in both directions, tool counts, docs links, API surface.

Two real drifts fixed rather than just detected:

• /health reported tools: 41 against 124 registered — and oauth-provider.test.ts asserted the 41, so the test had made the lie load-bearing. Now derived from a real registration run.
• store/docs was committed and stale (the checked-in MCP page was missing its entire Tool Surface section) and is not byte-reproducible, so no diff-based check could ever have gone green. Now untracked + gitignored; both ci.yml and deploy-host.yml rebuild it first. The "never stage store/docs" hazard is now structurally impossible rather than a convention.

It earned itself during its own rebase: it immediately caught GET/PUT /v1/instances/{id}/loop-presets from #234, landed hours earlier with no spec entry.