ci(release): a tag must not publish a component no CHANGELOG entry names

lint-gate already existed to enforce "do not RELEASE a tree whose lint failed",
because lint.yml does not run on tag pushes. scripts/check-doc-drift.sh had the
same gap and it was never extended to cover it: check 9 ran only in lint.yml, so
no tag build has ever evaluated it. Add it to lint-gate, which resolve-versions
already needs, so it fails in ~8 s ahead of the 46-minute base build.

For this check the gap is strictly worse than it is for shellcheck. Shellcheck
judges the tree, so green on main is still green at the tag -- the bytes did not
move. Check 9 judges the tree against upstream NOW, and the floating refs it
watches move with no commit here at all, so a green reading on main carries no
information about tag time. v1.9.3 is the worked example: pi-observational-memory
moved cba0334 -> e7d77dc the day AFTER the tag, nothing went red, and it
surfaced only because someone ran the gate by hand.

Measured, not assumed:
- Same file lint.yml calls (one reference in each workflow), not a second copy.
- Works on a CI-shaped checkout: cloned --depth 1 --no-tags (0 tags, 1 commit),
  rc=0. It needs no local tags because `last` comes from the Hub tags API, not
  `git tag`, so the plain actions/checkout@v4 above is sufficient.
- Has teeth: deleting the Unreleased section from that clone gives rc=1 and
  names the component; restoring it gives rc=0.
- ~8 s (7.8-8.3 s measured), vs ~1 s for lint-shell.sh.

Residual, accepted: the gate resolves the refs seconds before resolve-versions
resolves them again, so an upstream push inside that window still slips past.
Check 9 on the next release names it then.

.gitea/workflows/docker-publish.yml

@@ -174,6 +174,29 @@ jobs:
   #
   # ~40 s, ahead of everything expensive, and it runs scripts/lint-shell.sh --
   # the same file lint.yml calls, not a second copy that drifts.
+  #
+  # scripts/check-doc-drift.sh is here for the same reason and closes the same
+  # gap -- and for it the gap is strictly worse. Shellcheck judges the TREE:
+  # green on main is still green at the tag, because the bytes did not move.
+  # Check 9 judges the tree against UPSTREAM NOW, and the floating refs it
+  # watches (PI_OBSMEM_REF=master and friends, which resolve-versions below turns
+  # into SHAs) move with no commit in this repo at all -- so a green reading on
+  # main carries no information about tag time, and that window is exactly where
+  # releases live. Worked example: pi-observational-memory moved cba0334 ->
+  # e7d77dc the day AFTER v1.9.3 was tagged. Nothing went red; it surfaced only
+  # because someone ran the gate by hand. Without this step a tag can publish a
+  # component that no CHANGELOG entry names, and the floating ref means no other
+  # file in the repo would record it either.
+  #
+  # Adds ~8 s. No token and no built image: it takes the last published vX.Y.Z
+  # from the Hub tags API, that release's baked labels from the anonymous
+  # registry API, and `git ls-remote`s each upstream -- so a plain checkout is
+  # enough, with no tags or history to fetch. Offline it SKIPs loudly and
+  # counted rather than passing, so an outage degrades it to a visible skip
+  # instead of a false green. Residual, accepted: it resolves the refs seconds
+  # before resolve-versions resolves them again, so an upstream push landing
+  # inside that window still slips through -- and check 9 on the NEXT release
+  # would then name it.
   lint-gate:
     runs-on: ubuntu-latest
     container:
@@ -189,6 +212,9 @@ jobs:
       - name: "Shellcheck + syntax-check repository scripts (severity: error)"
         run: bash scripts/lint-shell.sh
 
+      - name: Components the next build would bake differently are named in the CHANGELOG
+        run: bash scripts/check-doc-drift.sh
+
   resolve-versions:
     # Gated: a defective tree must not reach a 46-minute base build.
     needs: [lint-gate]