docs: refresh project documentation inventory

[marcusrbrown]

Summary

• Update README.md for the current pnpm pin and 23 live GitHub Actions workflows.
• Add the current capture, private-leak, and gateway rollout workflows; remove stale workflow entries.
• Replace the invalid doc-generation test reporter command with pnpm test and keep test output untruncated.

Verification

• pnpm bootstrap && pnpm check-types && pnpm lint && pnpm test
• README workflow coverage check: 23 workflows, no missing entries, no duplicate entries in the workflow tables

[fro-bot]

The inventory holds. I cross-checked every mutable claim against the live tree at refs/pull/3590/merge, and the docs now match the repo instead of drifting from it.

Verdict: PASS

Blocking issues

None.

Non-blocking concerns

• README.md quality-gates table was converted from padded to compact (| --- |) pipes. This is consistent with the control-plane table directly below it and CI handles markdown formatting, so it's not a defect — just noting the two tables now share a style, which is the right direction.
• Capture Learnings purpose ("commit knowledge-wiki learnings to the data branch") is accurate at the flow level: the workflow grants the agent write-tier access and the commit happens inside the agent step, then Merge Data Branch promotes it. The row reads correctly; just be aware the commit isn't a literal step in the YAML for any future reader auditing it.

Missing tests

None — docs-only change. No runtime behavior, no test surface. Verification here is factual accuracy against the live repo, which I performed manually:

• pnpm@11.8.0 — matches package.json packageManager.
• 23 workflows — matches ls .github/workflows/*.yaml (was 21; +capture-learnings, +gateway-rollout-tracker net of removed rows).
• Every table entry maps to a real workflow name: field: Scorecard supply-chain security, Check Private Leak (workflow_run → "Workflow run"), Private Leak Sentinel (pull_request), Gateway Rollout Tracker (schedule/dispatch), Capture Learnings (schedule/dispatch), Fro Bot (+workflow_call) all confirmed.
• Fro Bot Autoheal and Social Broadcast rows removed — those workflow files no longer exist, and no stale references remain in README.md. Autohealing now lives inside the Fro Bot workflow's default pass, so dropping the standalone row is correct.
• Main purpose dropping CodeQL is accurate — main.yaml does not invoke CodeQL; CodeQL is its own row/workflow.
• SKILL.md edits (scripts/*.ts extraction + quality checks + commands block) replace pnpm test --reporter=basic 2>&1 | tail -5 with un-piped pnpm test and add explicit "do not pipe or truncate" guidance. That's a genuine correctness fix: truncating test output is exactly how stale counts sneak back into generated docs.

Risk assessment

LOW. Documentation-only diff (+17/-15) across README.md and a SKILL.md. No workflow logic, permissions, dependencies, or executable code touched. No injection surface, no secrets, no action pins involved. Worst-case failure mode is a doc going stale — and this PR is the opposite of that, pulling the inventory back into alignment. Aligns with the inventory-driven doc-drift cleanup pattern (docs/solutions/documentation-gaps/doc-drift-cleanup-pattern-2026-04-18.md): small, single-purpose, fact-checked against sources of truth.

---

Run Summary

Field	Value
Event	pull_request
Repository	fro-bot/.github
Run ID	28219415611
Cache	hit
Session	ses_0fd922229ffej2dwlK0vDVNatW