ci: add doc-validation hooks (markdownlint, typos, placeholder linter, lychee)

[andreahlert]

Adds doc validation hooks to pre-commit and a lychee link-check workflow. Catches the kind of bugs review currently has to find by eye.

The hooks:

• markdownlint-cli2 with a tight config (MD051 for broken anchors, MD053 for dangling link refs). Style rules off so the diff stays small and existing prose isn't churned.
• typos with project terms allowlisted in .typos.toml (CNA, Vulnogram, ponymail, mis-, Nd, pre-empted).
• tools/dev/check-placeholders.sh, a small bash linter that refuses hardcoded apache/airflow / Apache Airflow inside .claude/skills/ and tools/*.md. PR docs: tighten Airflow references to placeholders across framework files #1 already had to scrub these once. Cheaper to prevent the regression than redo the cleanup.

Lychee runs in a separate workflow on PRs and on a daily cron. Marked continue-on-error: true for now because the tree has 24 pre-existing broken refs to files that haven't landed yet (config/, projects/airflow/, the issue-template YAML). When the baseline hits zero we flip it to a hard gate.

Wiring this up surfaced five real broken anchors I fixed along the way:

• AGENTS.md link to #point-reporters-to-the-security-model-dont-re-explain-it was missing the "project's" prefix the actual heading uses.
• Two anchors in tools/ponymail/operations.md (#get-email, #get-thread) pointed at headings that are actually ## Get an email and ## Get a thread.
• Headings with → in projects/_template/scope-labels.md and tools/github/issue-template.md produce URL-encoded slugs that GitHub doesn't resolve. Renamed to to and re-ran doctoc.

Files

.markdownlint.json                 (new)
.lychee.toml                       (new)
.typos.toml                        (new)
tools/dev/check-placeholders.sh    (new, executable)
.github/workflows/link-check.yml   (new, informational)
.pre-commit-config.yaml            (+3 hooks)
CONTRIBUTING.md                    (documents the hooks)
AGENTS.md, projects/_template/scope-labels.md,
tools/github/issue-template.md, tools/ponymail/operations.md
                                   (anchor fixes)

Local run

prek run --all-files

Or one at a time:

npx markdownlint-cli2 "**/*.md"
typos
tools/dev/check-placeholders.sh
lychee --config .lychee.toml .

Test plan

• npx markdownlint-cli2 "**/*.md" clean.
• typos clean.
• tools/dev/check-placeholders.sh clean.
• lychee --offline . reports the 24 pre-existing breakages, no new ones from this PR.
• prek run --all-files green.

Out of scope

@potiuk, thinking about picking up a couple more fronts after this one if it lands well. Nothing huge, just smoothing edges:

• MD040 (fenced code language tags). 62 untagged fences in the tree, mechanical fix but it would balloon the diff, better as its own PR.
• MD038 (no-space-in-code). Most hits are intentional literal markdown samples like ` # `, ` ### `, ` - `. Re-enabling means escaping those consistently, again its own PR.
• Skill frontmatter schema validator. Useful eventually, but only 8 skills today and the shape rarely changes.
• Lychee as a blocking gate. Needs the 24 pre-existing breakages cleaned first.

Happy to do any or none of those, whatever fits the direction you have in mind.

---

Was generative AI tooling used to co-author this PR?

• Yes

[potiuk]

Fixed all failures. Merging. Yep. Improvements welcome @andreahlert :)