docs: generated terms.md with sync check

[chaksaray]

Closes #261. Glossary generated from live schema descriptions, never
hand-edited. check_terms_sync.py is a hard CI failure if terms.md and
the schema disagree, unlike this project's other soft-warning checks,
since a wrong glossary entry is worse than a missing one.

What's here

• scripts/generate_terms.py — the only thing that writes docs/terms.md's per-field section, from schema/ave-record-1.1.0.schema.json's own properties[name].description values (confirmed all 46 have a real, non-empty description before writing this).
• docs/terms-relationships.md — hand-written notes on the confusable field pairs, checked in separately, re-emitted verbatim by the generator rather than regenerated.
• scripts/check_terms_sync.py — fails if docs/terms.md doesn't match what the generator would produce right now. Hard failure (exit 1), not a soft warning — a deliberate, explicit break from this project's usual pattern (check_confidence_signal.py, check_framework_sources.py), since a stale glossary entry looks as authoritative as a correct one.
• tests/test_terms.py — 7 tests, each mutation-checked by hand (dropping sorted(), breaking the empty-description fallback, breaking crash-tolerance on an empty relationships string, breaking load_field_descriptions(), disabling the sync check's own comparison — each correctly turned exactly the test(s) naming that behavior red).
• Wired into .github/workflows/tests.yml as its own named step, and both commands added to CONTRIBUTING.md's local check list plus a dedicated line under Schema changes: regenerate after any field description change, before opening a PR.

Verified, not copied from the draft as given

Every relationship note was checked against the live schema and this project's actual history before writing it:

• entry_class's real enum is 14 values (content, server_card, registry_metadata, runtime, transport, tool_response, tool_schema, server_card_document, model_generated, memory, retrieved_document, user_input, operator_config, skill_file), broader than a first pass assumed — and its own schema description says to reuse detection_layer's value directly when the class is layer-scoped, so the note says the two are designed to share values in the common case, not to always diverge.
• verification_basis's substrate_reconstructed combination is confirmed as a real enum member and a real output of scripts/write_verification_basis.py's derivation logic, not an invented illustration.
• The framework_sources note's coverage claim is checked against the live corpus, not stated generically: owasp_mcp and owasp_asi are now fully backfilled (80/80, 69/69), mitre_atlas is 40 of 50, nist_ai_rmf has none — reflecting the recent backfill work (framework_sources backfill, and a real gap found: pin_status has no 'unknown' state #255, feat: framework_sources backfill (owasp_asi, mitre_atlas), and a schema fix it needed first #256, fix: owasp_mcp audit corrections (39 records) and framework_sources backfill #259). A generic "most records lack provenance" claim would already be stale.
• Issue Design question: confidence_baseline is self-reported, no structural verification #98 and PR docs: capability-behavior-vulnerability taxonomy audit (all 80 records) #224 were both fetched and read directly to ground the confidence_baseline/verification_basis and security_boundary/missing_control notes, rather than assumed from memory.

Validated

• python scripts/validate_records.py: 80/80 valid
• python scripts/check_fixtures.py: all pass
• python scripts/check_terms_sync.py: passes against the live schema
• pytest tests/ -x -q: 470 passed (463 existing + 7 new)