ci(check-links): 把 docs/adr/ 纳入断链检查,带围栏/行内代码判别与只减不增基线 (#6731)

`.github/workflows/check-links.yml` 只扫 content/** 与 README.md,docs/adr/
从未被检查过 —— 决策记录之间互相引用极密集(多数 `**Builds on**:` 行带
3-10 条相对链接),#5992 修掉的那条死链(0057 指向不存在的
`./0010-metadata-protection.md`)因此长期存活,久到一条 triage 评论把错误
归属继承并重复了一遍。

新增 `scripts/check-adr-links.mjs`(零依赖,`node` 直接跑),在同一条
advisory 车道(check-links.yml)里解析 docs/adr/ 的每一条相对链接目标。

判别机制:提取前先剥掉**围栏代码块与行内代码 span**。ADR-0046 是定义
package-docs 链接约定的那份记录,它按约定举例,故意写了本仓库不存在的
`./crm_lead_guide.md`(第 30 行代码 span、第 163 行 ```md 围栏、第 188 行
`![](…)`)—— 这三处写法正确,该学会读它们的是门,不是让文档迁就门。
⛔ 按文件 exclude 是被记录在案的陷阱:那会永久遮蔽该记录的 4 条真实互链。

8 条既有死链(全部是 ADR → 源码树、目标已移出本仓库)冻结在
`KNOWN_DEAD_TARGETS` 只减不增基线上,形状与 `check-adr-anchors` 的
`KNOWN_NUMBER_COLLISIONS`、`check:role-word` 一致:新增死链红,基线条目
不再对应死链也红(stale),基线活不过它的理由。lychee 的 `.lycheeignore`
表达不了这一点,而实测把 `docs/adr/**/*.md` 直接加进 lychee glob 会当场
报 8 条错 —— 让一条 advisory 车道从落地那天起长红,就是没人再看的门。


Claude-Session: https://claude.ai/code/session_01F8q5J1MQyocgtNspb15fSn

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-project-manager

.github/workflows/check-links.yml

@@ -33,6 +33,19 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
 
+      # ADR cross-link gate (#6592). `docs/adr/` is deliberately NOT added to the
+      # lychee globs below -- see the ⛔ note there for why -- so the decision
+      # registry gets its own resolver, in the same advisory lane.
+      #
+      # Deliberately `node` and not `pnpm`: the script has zero dependencies, so
+      # this lane needs no setup-node / corepack / `pnpm install`, and the whole
+      # advisory job stays a checkout plus two checks. It is also why an author
+      # can run it locally in any container (`pnpm check:adr-links` when a
+      # workspace install exists, `node scripts/check-adr-links.mjs` when it does
+      # not) -- which lychee, installed by the action at CI time, cannot offer.
+      - name: Check ADR cross-links
+        run: node scripts/check-adr-links.mjs --self-test && node scripts/check-adr-links.mjs
+
       - name: Check links with lychee
         uses: lycheeverse/lychee-action@v2
         with:
@@ -55,6 +68,18 @@ jobs:
           # suffix that a site route omits. Without this pair the gate cannot go
           # green at all: 1286 root-relative links fail as "Cannot resolve
           # root-relative link ... provide a root dir".
+          #
+          # ⛔ Do NOT add `docs/adr/**/*.md` here. It looks like the one-line fix
+          # for #6592 and it is not: measured on the pinned lychee 0.24.2, that
+          # glob reports 8 broken links today, every one a pre-existing ADR →
+          # source-tree link whose target moved out of this repo. This job would
+          # be red on every PR from the moment it merged, which is how an
+          # advisory lane becomes a lane nobody reads (#6028 landed it
+          # advisory-first specifically to earn a green streak). `docs/adr/` is
+          # checked by the `Check ADR cross-links` step above instead, which can
+          # freeze those 8 on a shrink-only baseline and fail on a NEW one --
+          # something neither `exclude` nor `.lycheeignore` can express, because
+          # neither ever tells you an entry stopped being needed.
           args: >-
             --offline
             --root-dir ${{ github.workspace }}/content

package.json

@@ -42,6 +42,7 @@
     "check:skill-frame-freshness": "node scripts/check-skill-frame-freshness.mjs --self-test && node scripts/check-skill-frame-freshness.mjs",
     "check:skill-compatibility": "node scripts/check-skill-compatibility-version.mjs --self-test && node scripts/check-skill-compatibility-version.mjs",
     "check:adr-anchors": "node scripts/check-adr-anchors.mjs --self-test && node scripts/check-adr-anchors.mjs",
+    "check:adr-links": "node scripts/check-adr-links.mjs --self-test && node scripts/check-adr-links.mjs",
     "check:platform-checklist": "node scripts/checklist-select.mjs --self-test && node scripts/check-platform-checklist.mjs",
     "check:org-identifier": "node scripts/check-org-identifier.mjs",
     "check:authz-resolver": "node scripts/check-single-authz-resolver.mjs --self-test && node scripts/check-single-authz-resolver.mjs",