ci: AI Validation rewrite — MyST + split-job + branch map

Rewrites .github/workflows/ai-validation.yml to align with the docs
current→rolling rename and the RST→MyST migration. The body is a
byte-for-byte copy of the canonical reference at
VyOS-Networks/vyos-docs-opus-reviewer/scripts/ai-validation.yml at
tag reviewer-v1.0.0 (header stripped on copy).

Key changes vs the previously deployed (and currently disabled)
workflow:

- Trigger pull_request → pull_request_target (required for fork PRs
  to access secrets) with a split prepare/validate job pattern that
  preserves the trust boundary.
- prepare job: NO secrets referenced; checks out the PR merge ref
  with persist-credentials:false; emits NUL-delimited diffs +
  bundles changed .md files into _changed_md/ via xargs cp.
- validate job: secrets-availability check; sparse-checkout of
  branches.json from the reviewer repo (pinned via REVIEWER_REF
  env var, default reviewer-v1.0.0); fail-fast resolution of
  docs branch → vyos-1x branch via jq lookup; mapped vyos-1x
  checkout; reference-DB download (best-effort); fail-closed
  gate when MyST files are in the diff but the DB is missing;
  Pass 1 runs from inside _changed_md/ so diff-relative paths
  resolve; Pass 2 via claude-code-action with hardened prompt
  (untrusted-content ringfence, narrow tool allowlist).
- Concurrency: PR-scoped concurrency cancels superseded runs.
- Runners: [self-hosted, web] (org-level VyOS runner pool).
- Action versions bumped for Node-24 compat:
  - actions/create-github-app-token@v2
  - actions/setup-python@v6
  - robinraju/release-downloader@<v1.13 SHA-pin>

Required secrets in vyos/vyos-documentation:
  ANTHROPIC_API_KEY, VYOS_APP_ID, VYOS_APP_PRIVATE_KEY

Implements:
- VyOS-Networks/vyos-docs-opus-reviewer
  docs/superpowers/specs/2026-05-10-myst-parser-and-workflow-fix-design.md

Workflow remains disabled_manually while this PR is in review.
After merge, re-enable via:

  gh api repos/vyos/vyos-documentation/actions/workflows/259251949/enable -X PUT

🤖 Generated by [robots](https://vyos.io)

0 files changed, 0 insertions, 0 deletions