ci: add pinned source-link checker

[dobby-coder]

Adds a checker for the pinned GitHub source links in docs/, per #120.

What it does

scripts/check-source-links.mjs greps docs/ for pinned links of the form https://github.com/<owner>/<repo>/blob/<hash>/<path>, then checks each one resolves via the GitHub contents API with ref=<hash>. It reads GITHUB_TOKEN/GH_TOKEN from the environment when present, so private repos resolve and the unauthenticated rate limit (60 req/hour) is lifted. It exits non-zero and lists any link that 404s, and exits 0 when all resolve.

Wired in as npm run check:links.

This is an HTTP existence check only. It does not compare line ranges or snippet content against the file, matching the scope in #120 (that deeper check is explicitly out of scope).

Verified locally

• npm run check:links finds 45 unique pinned links and reports all resolve (matches the count in the issue).
• Injecting a link with a non-existent path made it exit 1 and print the broken URL.

Non-200, non-404 responses (rate limit, auth, network, 5xx) are reported separately as "could not verify" and also exit non-zero, so a run that could not confirm the links never shows green.

CI wiring (needs a maintainer)

The Dobby App cannot push to .github/workflows/, so this PR does not touch CI. All repos currently linked from docs/ are public, so the built-in GITHUB_TOKEN resolves them and lifts the rate limit. Suggested addition to .github/workflows/ci.yml:

  check-links:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Check pinned source links
        run: npm run check:links
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Closes #120

[dobby-coder]

VERDICT: approve

Rules + review sweep for the pinned source-link checker. No blocking issues.

Checked and clean:

• PR title and commit ci: add pinned source-link checker satisfy the semantic-PR title check (pr-title.yml is present).
• Body has Closes #120, so the tracking issue auto-closes on merge.
• No .github/workflows/ files touched; the CI job is proposed as a patch in the body for a maintainer.
• Reviewer @rubenhensen is requested.
• apiPath decode-then-reencode handles + and encoded parens in blob paths correctly, and non-200/non-404 responses exit non-zero so a run that could not confirm never shows green.

One non-blocking note (nit): LINK_RE stops the path group at ), so a link whose path has a literal unencoded parenthesis (e.g. a SvelteKit route group /routes/(app)/+page.svelte) would be truncated and could 404 as a false positive. No current docs link hits this — the encoded %28app%29 form resolves fine and all 45 links pass — so it is a latent edge, not something to fix now. Widening the group to allow ) is risky because markdown wraps URLs in [text](url), so the trailing ) must stay excluded. Leaving as a comment.

Verified: npm run check:links finds 45 unique links, all resolve (exit 0); injecting a bad path/repo yields 404s with exit 1.

[dobby-coder]

Nit (non-blocking): the path group stops at ), so a literal unencoded parenthesis in a path (e.g. a SvelteKit route group /routes/(app)/+page.svelte) would be truncated and could 404 as a false positive. All 45 current links use the encoded %28app%29 form and pass, so this is a latent edge only. Widening to allow ) is risky since markdown wraps URLs in [text](url).