Add authoritative DocsCheck profile

[rcs2153]

Summary

• add docs_check as the second closed explicit authoritative local-check profile
• route the canonical check through existing immutable-run, same-call attestation, and proportional-governance execution
• keep project activation, CLI defaults, ambient registration, providers, and writes unchanged
• update the authoritative roadmap and include implementation/review evidence

Validation

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• npm run check:docs
• git diff --check

Governed evidence

• implementation: dg/runtime-composition, run run-1786606027190141000-2, proof-bound approval granted, 39 events, no retries/escalations
• review: dg/review, run run-1786607619687680000-2, proof-bound approval granted, 39 events, no retries/escalations

Boundaries

No arbitrary commands, default registration, project-level DocsCheck activation, CLI default changes, automatic local-check execution, provider calls, writes, OpenShell changes, persistence redesign, or release posture changes.