Add doc entrypoint freshness detector

[marcusglee11]

Summary

Implements the first read-only detector slice for LifeOS#125: low-noise entrypoint freshness checks for the README/operator read-order baseline.

What changed

• Adds check_entrypoint_freshness() in doc_steward/freshness_validator.py.
• Detects missing README read-order links for:
  • docs/INDEX.md
  • docs/08_manuals/LifeOS_Operator_Onboarding.md
  • docs/11_admin/LIFEOS_STATE.md
  • docs/00_foundations/LifeOS Target Architecture v2.3c.md
• Detects stale README Phase 4/Tier-3 status wording when LIFEOS_STATE reflects later COO state.
• Detects missing canonical-vs-derived README boundary wording.
• Detects authority-registry mismatch for docs/INDEX.md as canonical and docs/LifeOS_Strategic_Corpus.md as derived.
• Adds focused pytest coverage.

Verification

• python3 -m pytest tests_doc/test_freshness_validator.py -q → 18 passed.
• git diff --check → passed.
• Local dry-run against current origin/main checkout: check_entrypoint_freshness('.') → findings 0.

Boundaries

• No doc auto-editing.
• No recurring sweep/cron wiring or activation.
• No merge requested by this PR.
• This is a detector substrate slice only.

Refs #125.

[marcusglee11]

Review bar: inert_implementation — fresh-context EA advisory review plus local focused gate. This is a read-only detector/test PR; no runtime, scheduler, merge, or activation authority is exercised here.

Result: APPROVE / no required changes.

What I reviewed:

• doc_steward/freshness_validator.py
• tests_doc/test_freshness_validator.py
• README read-order detection, stale Phase 4/Tier-3 status detection, derived-vs-canonical boundary detection, authority registry mismatch handling, and existing freshness-mode behavior.

Review findings actioned before this comment:

• Replaced the brittle line-oriented authority-registry scan with yaml.safe_load.
• Added fail-closed handling for malformed registry YAML and malformed registry shapes.
• Added regression coverage for quoted YAML values, malformed YAML, scalar/non-mapping registry structures, missing derived boundary wording, and missing required input files.

Verification:

• Focused tests: python3 -m pytest tests_doc/test_freshness_validator.py -q → 26 passed.
• Local quality gate: python3 scripts/workflow/quality_gate.py check --scope changed --json → passed, 0 blocking failures. mypy remains advisory/unavailable locally.
• Final fresh-context review verdict: APPROVE, required changes [].

Residual notes:

• Detector is intentionally heuristic and read-only. It is suitable for low-noise sweep findings, not semantic doc-authority adjudication.
• The new detector remains inert until a caller explicitly invokes it.