Replace the single-consumer documentation workflow with a local action #331

🤖 Generated by the Agentic Engineer

Problem

The documentation-link guard is exported as a reusable workflow but has only one job-level caller, the repository's CI. It also runs directly after merges. This makes a repository-owned concern look like a reusable pipeline.

Outcome

Keep the PR gate and independent main-branch observation, but share their steps through a local composite action. Preserve the bounded documentation scope, read-only credentials, clean scan and both failure controls. The required CI aggregate must continue to depend on this guard.

Acceptance

• No single-consumer workflow_call export remains.
• Both native entrypoints call the same local action.
• Behavioral regression controls still reject a skipped scan, write credentials, missing configuration and lost aggregation.
• Exact-head CI and review, protected merge and post-merge observation are verified.

Part of #96. Covered by the maintainer's scoped workflow-cleanup WIP exception.