chore(docs): build the docs with pnpm and lint markdown with rumdl

[BeArchiTek]

Summary

The documentation toolchain was the last part of this repository still reaching for npm: the site was built with npm install, and the markdown-lint job installed markdownlint-cli globally on every run. Both diverge from infrahub-mcp and infrahub-sync, which build their docs with pnpm and lint Markdown with rumdl through uv. This brings the toolchain into line with them, and fixes two CI checks that were silently not doing their job.

Key Changes

• Contributors get the same docs toolchain as the other repositories. The site builds with pnpm: docs/pnpm-lock.yaml replaces docs/package-lock.json, docs/package.json pins pnpm 11.6.0, and build-docs.sh, the invoke tasks and CI all install with pnpm install --frozen-lockfile. invoke docs.install and invoke docs.build still work as before.
• Markdown linting no longer needs a global npm install in CI. rumdl runs through uv, configured under [tool.rumdl] in pyproject.toml. The rules are a one-for-one translation of the previous .markdownlint.yaml, so no repository content had to change; the single finding was in the generated docs/docs/home.mdx and is fixed in the template it comes from.
• The documentation freshness check can now actually fail. It compared docs/reference/, but the generated pages live in docs/docs/reference/. The path matched nothing, so the check exited zero unconditionally — stale generated docs have never been caught.
• Workflow files are linted for the first time. yamllint ignored .github/ wholesale. It now lints them, with truthy: check-keys: false so bare on: keys need no inline disable, and the two findings this surfaced in sync-docs.yml are fixed.
• CI runs with least privilege, with a top-level permissions: contents: read and pull-requests: read scoped to the job that needs it. Action majors are pinned to the ones the sibling repositories use.

Notes for reviewers

• docs/pnpm-workspace.yaml is the one non-obvious file. pnpm 10 and later block unapproved dependency build scripts and exit non-zero; without declaring that core-js needs no build step, pnpm install --frozen-lockfile fails in CI. Both sibling repositories carry the same file for the same reason.
• docs/pnpm-lock.yaml is YAML where package-lock.json was JSON, so yamllint sees it for the first time and it is added to the ignore list.
• Node moves from 20 to 22 in .nvmrc and in CI, which pnpm 11 requires.
• ci.yml keeps a narrowed # yamllint disable rule:line-length for the Vale find invocation, matching infrahub-mcp.

Test Plan

Run locally on this branch — all pass:

uv run yamllint -s .
uv run ruff check . && uv run ruff format --check --diff .
uv run mypy --show-error-codes . && uv run pylint --ignore .venv .
uv run pytest
uv run rumdl check .
cd docs && pnpm install --frozen-lockfile
uv run invoke docs.build
uv run invoke docs.generate   # leaves docs/docs/reference/ unchanged

actionlint reports the same seven pre-existing shellcheck notes before and after this change, so no new workflow issues were introduced.

---

Assisted-by: opsmill-repo-auditing-repo-standards 0.1.0
Assisted-by: opsmill-dev-commit 0.1.0
Assisted-by: opsmill-dev-pr 0.2.0