ci: add docs-privacy gate over docs/**

.github/workflows/docs-privacy.yml

@@ -0,0 +1,23 @@
+# docs-privacy.yml — docs-privacy gate. Required check name: "docs-privacy".
+# Proves no private piloting marker leaks into the published docs/** (anti-regression
+# at HEAD). check_docs_private_markers is decidable and prefix-anchored (METHOD section 6).
+name: docs-privacy
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions:
+  contents: read
+jobs:
+  docs-privacy:
+    name: docs-privacy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+      # Exact-version pin (determinism + CI<->local parity) via the runtime group.
+      - run: python -m pip install --upgrade pip && pip install --group runtime
+      # Gate command single-sourced in scripts/gates/docs-privacy.sh (S31).
+      - run: bash scripts/gates/docs-privacy.sh

scripts/gates/docs-privacy.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Gate command for the `docs-privacy` CI check, single-sourced (METHOD section 6 / S31).
+# Proves no private piloting marker leaks into docs/** (check_docs_private_markers).
+set -e
+python scripts/check_docs_private_markers.py