test: cover root-level *.md relative link and anchor integrity (tests/root-docs-links.test.mjs)

[kubestellar-hive]

Test Improvement

Adds one test-only file, tests/root-docs-links.test.mjs (7 tests), covering relative-link and anchor integrity across the ten root-level *.md files: AGENTS.md, CODE_OF_CONDUCT.md, CONTRIBUTING.md, GOVERNANCE.md, LAUNCH.md, MAINTAINERS.md, MILESTONES.md, README.md, ROADMAP.md, SECURITY.md.

Files claimed by this PR: tests/root-docs-links.test.mjs (new). Nothing else — no production code, no content, no workflow file, no package.json, no lockfile, no dependency. tests/helpers.mjs is deliberately untouched (claimed by #231).

The gap

Those files carry 18 relative links into the repository, and three mechanisms each look like they cover them while none does:

1. npm run check:links resolves to make --keep-going check-links; there is no Makefile in this repository, so it cannot run (fix: rewire check:links off missing Makefile and drop orphan typecheck script #291 is rewiring it).
2. docusaurus.config.js:33 sets onBrokenMarkdownLinks: 'warn' — and root-level *.md are not in the Docusaurus route tree at all, so the build never reads them and the warning never applies.
3. The unit suite contains no test that opens a root-level markdown file: grep -rln 'README.md\|CONTRIBUTING.md\|GOVERNANCE.md' tests/ returned nothing before this change.

Renaming MAINTAINERS.md, adr/0001-site-ownership-and-cutover-path.md, or a heading in docs/skills/blog-management.md therefore breaks the contributor-facing entry points with no CI signal. #205, #236, #244 and #246 are all open PRs editing exactly this set of files.

The 7 assertions

1. The root-level *.md set is non-empty and contains README.md and CONTRIBUTING.md.
2. At least one relative link exists, so assertion 3 cannot pass vacuously.
3. Every relative link and image resolves to a path that exists on disk.
4. Every #fragment on a cross-file .md/.mdx link matches a heading slug in the target.
5. Every same-document #fragment link matches a heading in that same document.
6. Nothing links into node_modules/, build/ or .docusaurus/.
7. Links that escape the repo root are only GitHub's repo-relative idiom — SECURITY.md's ../../security/advisories/new resolves against the repository URL, not the file tree, so it is exempted by an explicit allowlist of GitHub path roots rather than by a filesystem check that happens not to fail.

Fenced and inline code are stripped before matching, so link-like text in examples is ignored.

This is a guard, not a repair

All 18 links resolve at 00b44df; the suite lands green and stays green until something breaks.

Verification

• node --test at rev 00b44df: 62 tests pass, 0 fail (55 existing + 7 new).
• Every assertion mutation-checked to confirm it bites: appending [x](NOPE.md), [x](ROADMAP.md#no-such-heading), [x](#no-such-heading), [x](node_modules/foo/README.md) and [x](../../../etc/passwd) to README.md each turned exactly the corresponding test red, and renaming the real ## Publishing cadence heading in docs/skills/blog-management.md turned assertion 4 red. The working tree was restored clean after each.
• npx prettier --check tests/root-docs-links.test.mjs passes.

Scope / non-overlap

One cluster: relative-link and anchor integrity in root-level *.md. Disjoint from #296 (docs/ tree only), #235 (MILESTONES.md ↔ data/milestones.json parity), #282 (adr/ records), #270 (blog/ frontmatter), #275 (navbar/sidebar wiring), #289 (/img static assets) and #278 (package.json/workflow script wiring). No src/ module is imported, so this does not depend on or conflict with the JSX test harness in #229.

Related Issue

Closes #308

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5

[kubestellar-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.