docs: render llms.txt at build time (circinus)

Parity with [#1874](https://github.com/vyos/vyos-documentation/pull/1874) (current) and [#1876](https://github.com/vyos/vyos-documentation/pull/1876)
(sagitta). Replaces the static `docs/_html_extra/llms.txt` with a Jinja
template (`docs/_templates/llms.txt.j2`) rendered at build time via a
`build-finished` hook in `conf.py`. URLs and the version line are
interpolated from `html_baseurl` and `release`, so the rendered file
always matches what circinus actually serves.

Hook behavior matches `current`/`sagitta` exactly, including the two
review-cycle hardenings landed on those PRs:

- Skips on builders other than `html` and `readthedocs` — the curated
  template encodes `.html` URLs which don't match `dirhtml` output.
- `RuntimeError` if `html_baseurl` is empty rather than silently
  rendering broken root-relative URLs.
- Jinja `Environment(undefined=StrictUndefined)` so a typo in
  `llms.txt.j2` raises at build time instead of writing a half-blank
  `llms.txt`.

The closed PR [#1875](https://github.com/vyos/vyos-documentation/pull/1875) was the previous attempt; this re-lands the change after the
post-flip rebase situation cleared.

Verified locally: hook tests (happy-path render, fail-fast on
`html_baseurl=None`/`''`, `StrictUndefined` catches `{{ relase }}`
typo, skips `dirhtml`, skips on build exception) pass against this
worktree.

\xf0\x9f\xa4\x96 Generated by [robots](https://vyos.io)

3 files changed, 88 insertions, 54 deletions

diff --git a/docs/_html_extra/llms.txt b/docs/_html_extra/llms.txt
deleted file mode 100644
index 03d8562d..00000000
--- a/docs/_html_extra/llms.txt
+++ /dev/null
@@ -1,52 +0,0 @@
-# VyOS
-
-> VyOS is a free, open-source network operating system based on Debian GNU/Linux.
-> It provides routing, firewall, and VPN functionality via a unified CLI using
-> `set`/`delete`/`show` command hierarchy. This documentation covers 1.5.x (circinus).
-
-VyOS configuration follows a tree structure. All configuration commands start with
-`set` (to add/change) or `delete` (to remove). Changes are staged and applied with
-`commit`. The CLI hierarchy maps directly to the documentation structure.
-
-## Quick Start
-
-- [Quick Start Guide](https://docs.vyos.io/en/1.5/quick-start.html): Minimal setup walkthrough
-- [CLI Overview](https://docs.vyos.io/en/1.5/cli.html): Command-line interface usage
-
-## Configuration
-
-- [Firewall](https://docs.vyos.io/en/1.5/configuration/firewall/index.html): Zone-based firewall, rules, groups
-- [Interfaces](https://docs.vyos.io/en/1.5/configuration/interfaces/index.html): Ethernet, bonding, bridge, VLAN, tunnel, wireless
-- [Protocols](https://docs.vyos.io/en/1.5/configuration/protocols/index.html): BGP, OSPF, IS-IS, static routing, MPLS
-- [VPN](https://docs.vyos.io/en/1.5/configuration/vpn/index.html): IPsec, OpenVPN, WireGuard, L2TP, PPTP
-- [NAT](https://docs.vyos.io/en/1.5/configuration/nat/index.html): Source NAT, destination NAT, NAT66
-- [System](https://docs.vyos.io/en/1.5/configuration/system/index.html): DNS, NTP, syslog, users, task scheduler
-- [High Availability](https://docs.vyos.io/en/1.5/configuration/highavailability/index.html): VRRP
-- [Load Balancing](https://docs.vyos.io/en/1.5/configuration/loadbalancing/index.html): WAN and reverse proxy
-- [Containers](https://docs.vyos.io/en/1.5/configuration/container/index.html): Podman-based container support
-- [PKI](https://docs.vyos.io/en/1.5/configuration/pki/index.html): Certificate management
-- [Policy](https://docs.vyos.io/en/1.5/configuration/policy/index.html): Route maps, prefix lists, access lists
-- [Traffic Policy](https://docs.vyos.io/en/1.5/configuration/trafficpolicy/index.html): QoS and shaping
-- [Service](https://docs.vyos.io/en/1.5/configuration/service/index.html): DHCP, DNS forwarding, SNMP, SSH, HTTPS API
-- [VRF](https://docs.vyos.io/en/1.5/configuration/vrf/index.html): Virtual routing and forwarding
-
-## Operations
-
-- [Operational Commands](https://docs.vyos.io/en/1.5/operation/index.html): Show, monitor, restart commands
-
-## Installation
-
-- [Installation Guide](https://docs.vyos.io/en/1.5/installation/index.html): Bare metal, virtual, cloud deployments
-
-## Automation
-
-- [Automation](https://docs.vyos.io/en/1.5/automation/index.html): Ansible, Terraform, HTTP API, NETCONF
-
-## Configuration Examples
-
-- [Blueprints](https://docs.vyos.io/en/1.5/configexamples/index.html): Real-world topology examples
-
-## Optional
-
-- [Contributing](https://docs.vyos.io/en/1.5/contributing/index.html): Development workflow
-- [VPP](https://docs.vyos.io/en/1.5/vpp/index.html): Vector Packet Processing integration
diff --git a/docs/_templates/llms.txt.j2 b/docs/_templates/llms.txt.j2
new file mode 100644
index 00000000..db579e83
--- /dev/null
+++ b/docs/_templates/llms.txt.j2
@@ -0,0 +1,52 @@
+# VyOS
+
+> VyOS is a free, open-source network operating system based on Debian GNU/Linux.
+> It provides routing, firewall, and VPN functionality via a unified CLI using
+> `set`/`delete`/`show` command hierarchy. This documentation covers {{ release }}.
+
+VyOS configuration follows a tree structure. All configuration commands start with
+`set` (to add/change) or `delete` (to remove). Changes are staged and applied with
+`commit`. The CLI hierarchy maps directly to the documentation structure.
+
+## Quick Start
+
+- [Quick Start Guide]({{ baseurl }}quick-start.html): Minimal setup walkthrough
+- [CLI Overview]({{ baseurl }}cli.html): Command-line interface usage
+
+## Configuration
+
+- [Firewall]({{ baseurl }}configuration/firewall/index.html): Zone-based firewall, rules, groups
+- [Interfaces]({{ baseurl }}configuration/interfaces/index.html): Ethernet, bonding, bridge, VLAN, tunnel, wireless
+- [Protocols]({{ baseurl }}configuration/protocols/index.html): BGP, OSPF, IS-IS, static routing, MPLS
+- [VPN]({{ baseurl }}configuration/vpn/index.html): IPsec, OpenVPN, WireGuard, L2TP, PPTP
+- [NAT]({{ baseurl }}configuration/nat/index.html): Source NAT, destination NAT, NAT66
+- [System]({{ baseurl }}configuration/system/index.html): DNS, NTP, syslog, users, task scheduler
+- [High Availability]({{ baseurl }}configuration/highavailability/index.html): VRRP
+- [Load Balancing]({{ baseurl }}configuration/loadbalancing/index.html): WAN and reverse proxy
+- [Containers]({{ baseurl }}configuration/container/index.html): Podman-based container support
+- [PKI]({{ baseurl }}configuration/pki/index.html): Certificate management
+- [Policy]({{ baseurl }}configuration/policy/index.html): Route maps, prefix lists, access lists
+- [Traffic Policy]({{ baseurl }}configuration/trafficpolicy/index.html): QoS and shaping
+- [Service]({{ baseurl }}configuration/service/index.html): DHCP, DNS forwarding, SNMP, SSH, HTTPS API
+- [VRF]({{ baseurl }}configuration/vrf/index.html): Virtual routing and forwarding
+
+## Operations
+
+- [Operational Commands]({{ baseurl }}operation/index.html): Show, monitor, restart commands
+
+## Installation
+
+- [Installation Guide]({{ baseurl }}installation/index.html): Bare metal, virtual, cloud deployments
+
+## Automation
+
+- [Automation]({{ baseurl }}automation/index.html): Ansible, Terraform, HTTP API, NETCONF
+
+## Configuration Examples
+
+- [Blueprints]({{ baseurl }}configexamples/index.html): Real-world topology examples
+
+## Optional
+
+- [Contributing]({{ baseurl }}contributing/index.html): Development workflow
+- [VPP]({{ baseurl }}vpp/index.html): Vector Packet Processing integration
diff --git a/docs/conf.py b/docs/conf.py
index 23c76d3e..ec95bf76 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -147,8 +147,10 @@ html_context = {
 # sphinx-sitemap: baseurl already includes /en/1.5/, so skip lang+version
 sitemap_url_scheme = '{link}'
 
-# sphinx-llms-txt: disable auto-generated llms.txt, keep curated one from
-# _html_extra; llms-full.txt is still auto-generated
+# sphinx-llms-txt: disable the package's auto-generated index llms.txt.
+# The curated llms.txt is rendered at build time from
+# _templates/llms.txt.j2 by the _write_llms_txt() build-finished hook
+# below; llms-full.txt is still auto-generated by sphinx-llms-txt.
 llms_txt_file = False
 
 # Custom sidebar templates, must be a dictionary that maps document names
@@ -258,6 +260,38 @@ def _copy_md_sources(app, exception):
         shutil.copy2(path, dest)
 
 
+def _write_llms_txt(app, exception):
+    # Skip dirhtml: the curated template encodes `.html` URLs (e.g.
+    # `quick-start.html`), which don't exist under `dirhtml` output
+    # (`quick-start/index.html`). Production publishes via the html /
+    # readthedocs builders, so dirhtml output would just be misleading.
+    if exception is not None or app.builder.name not in (
+            'html', 'readthedocs'):
+        return
+    if not app.config.html_baseurl:
+        # Fail loudly rather than rendering /quick-start.html etc. as a
+        # silently-broken root-relative URL — every supported branch
+        # sets html_baseurl, so a missing value is a regression.
+        raise RuntimeError(
+            'html_baseurl must be set to render llms.txt')
+    from pathlib import Path
+    from jinja2 import Environment, StrictUndefined
+    tpl_path = Path(app.srcdir) / '_templates' / 'llms.txt.j2'
+    out_path = Path(app.outdir) / 'llms.txt'
+    baseurl = app.config.html_baseurl.rstrip('/') + '/'
+    # StrictUndefined: missing template variables raise rather than
+    # silently render as empty strings, so a typo in llms.txt.j2 fails
+    # the build instead of shipping a half-blank llms.txt.
+    env = Environment(undefined=StrictUndefined, keep_trailing_newline=True)
+    template = env.from_string(tpl_path.read_text(encoding='utf-8'))
+    rendered = template.render(
+        baseurl=baseurl,
+        release=app.config.release,
+    )
+    out_path.write_text(rendered, encoding='utf-8')
+
+
 def setup(app):
     app.connect('builder-inited', _prefer_webp)
     app.connect('build-finished', _copy_md_sources)
+    app.connect('build-finished', _write_llms_txt)