feat(CC-514): cross-document drift lint for GENERATED policy tables

[screenleon]

Summary

• Delivers CC-514's remaining Req 5 (cross-document lint) and Req 6 (drift ratchet), collapsed into one mechanism per pre-impl design review: a new tools/lint/check-policy-doc-sync.sh dynamically discovers every <!-- BEGIN GENERATED: <source> --> markdown table in any doc and verifies it still matches the core/policy/* file it claims to mirror. Dynamic discovery is itself the ratchet — a new marked block anywhere is checked the moment it exists, with no separate registration step, so Req 6 doesn't need a second artifact.
• Five TSV-sourced blocks use a generic comparator (render the source as markdown rows, compare whole lines — cell-splitting would misparse the policy-signals table's regex patterns, which contain unescaped literal |). The one YAML-sourced block (core/policy/reviewer-policy.yaml) gets a dedicated comparator rather than a general YAML-to-table renderer — a scoped tradeoff confirmed with the user, revisited only if a second YAML-shaped source actually shows up.
• Wired into .github/workflows/lint.yml (a direct real-repo run plus its own regression-test job) and the tests/lib/test-suite-runner.sh / tests/shell/test-run-all-tests.sh suite registries.
• Updated docs/delivery-assurance-map.md's own provenance note and "no automated lint" disclaimer, since both had gone stale as of this PR. CC-514 fully closes (all 7 requirements now delivered).

Review history

• Mandatory reuse/simplify pass (4 parallel review angles) found and fixed 4 real issues before the first gate round: the YAML comparator read its source twice and cell-split doc rows instead of the whole-line strategy its TSV sibling used (rewritten to one pass, one strategy); the doc-file marker scan forked awk twice per file for overlapping work (merged into one pass); git ls-files without --others silently skipped a brand-new, not-yet-git added doc file, contradicting the script's own "no registration step" claim (fixed, with a new regression case).
• pr-gate round 1 (codex, parallel, standard tier): NO-GO — 3 real findings, all fixed:
  • qa-tester: doc-side extraction silently discarded any non-table-row line inside a block, so injected prose/markup would go unnoticed. Fixed: any non-blank, non-table-row line inside a block is now rejected outright.
  • security-reviewer: a marker's source path is attacker-controlled (PR-authored doc text) and was read with no containment check — a symlinked or path-traversing source could disclose arbitrary file content in CI logs. Fixed: rejects a symlinked source outright and verifies the fully resolved path lands exactly where the literal, unresolved concatenation says it should, before reading anything.
  • risk-reviewer: a nested BEGIN marker silently overwrote the outer block's own bookkeeping, leaving it completely unverified — a false pass. Fixed: nested markers are now a distinct, explicit rejection.
• pr-gate round 2 (targeted, sequential): GO — all five reviewers approved.

Test plan

• bash tests/shell/test-check-policy-doc-sync.sh (15/15, run 3x for stability)
• bash tools/lint/check-policy-doc-sync.sh clean against the real repo (6 blocks across 1 file)
• tools/lint/lint-shellcheck.sh clean on the whole repo
• tools/lint/lint-test-suite-registry.sh — registry/CI parity holds
• pmctl gate run --executor codex --policy generic → GO (2 rounds; round 1's 3 real findings fixed)
• tests/bin/run-all-tests.sh → 105 passed, 0 failed, 0 skipped

🤖 Generated with Claude Code

https://claude.ai/code/session_0177ds9nxEMtsh3bwpBxNHYx