ci: make the docs agree with the binary, since reading has not stuck

[lex00]

Closes #68. Ticks another of #54's items, this one for good rather than until next time.

#54 lists README-versus-docs drift as open with the note "they have drifted before". They had, twice, and both times it was closed by reading. The last one was -serve-sts — named in four doc pages and in no README, while being the flag that decides whether the KubeMicroVM operator starts at all.

What it checks

Only things with a single right answer:

• every flag the docs name is a flag the binary has
• every flag the binary has is named somewhere in the docs
• the operation totals the prose claims match what routes.go routes
• api-surface.md's per-family counts sum to that total — two numbers that are each individually plausible and do not add up is exactly the drift nobody notices

Deliberately not checked: that the README repeats what the docs say. It does not, on purpose — after #72 the README is a lead-in and docs/using-it.md is the reference. A parity rule between them would fight that on every commit.

What running it found

Three flags with no documentation anywhere: -addr, -log-level, -version. Documented rather than exempted, which is how the whole flag surface ended up in one table for the first time.

Verified failing in both directions

$ # add a flag to the binary, document nothing
docs-consistency: the binary has -not-documented-anywhere and no doc page names it

$ # add a row for a flag that does not exist
docs-consistency: docs name a flag the binary does not have: -a-flag-that-does-not-exist