ci: docs-only exemption skips the capability inventory's owning checker

[forkwright]

Finding

The docs-only exemption added for #775 skips the kernel job's source-level wiring-inventory check even when the changed document is the inventory itself. A malformed docs/capability-inventory.toml can therefore receive the required kernel context without the repository mechanism that validates its module coverage, witness claims, and compiled-only ownership reasons.

Evidence

PR #943 is an affirmative docs-only witness:

• CI run: https://github.com/forkwright/thumos/actions/runs/33011502905
• required kernel job: https://github.com/forkwright/thumos/actions/runs/33011502905/job/98318702043
• the exemption report succeeds and all 33 original kernel steps (steps 3–35) are skipped
• scripts/check-wiring-inventory.sh is one of those skipped steps
• no other job in .github/workflows/ci.yml invokes it

PR #943 itself is safe: an independent local scripts/check-wiring-inventory.sh --no-log run reports all 121 modules classified across 30 capabilities and all declared witness/source invariants valid. The gap is in admission for a future inventory edit.

Desired correction

Run the source-only half of the canonical checker for docs-only changes, preferably in the fast fmt job:

scripts/check-wiring-inventory.sh --no-log

Keep boot-log assertion in the full kernel path. Do not duplicate the checker or weaken the docs-only exemption.

Done when a docs-only change to docs/capability-inventory.toml still avoids kernel build/QEMU work but cannot merge with an unclassified/duplicate module, missing witness assertion, or ownerless compiled-only capability.

[forkwright]

Completion audit found that #950 landed the checker but not the merge-blocking property this issue requires.

On current main, scripts/check-wiring-inventory.sh --no-log runs in the rustfmt job (.github/workflows/ci.yml:41-80). Live branch protection requires only cargo audit, cargo deny, gate / gate, conventional-commit grammar, and kernel (i686 tests + armv7a build); no ruleset adds rustfmt. The required kernel job still checks out the tree only when DOCS_ONLY != 'true' and therefore runs no inventory checker on the docs-only path.

Consequently a malformed docs-only docs/capability-inventory.toml can fail the unrequired rustfmt job while every required context succeeds. That falsifies this issue's explicit done-when: such a change still can merge with an unclassified/duplicate module, missing witness assertion, or ownerless compiled-only capability.

Reopened for the narrow correction: move the source-only check into the always-running required kernel context (including its checkout), retain the full boot-log assertion on non-doc changes, and remove the non-authoritative duplicate from rustfmt. A deliberately malformed docs-only inventory must make the required kernel context red while the expensive build/QEMU steps remain skipped.

The same audit found stale current-owner prose at docs/capability-inventory.toml:18: it says closed #871 still owns centralized uaccess work now landed by #952. Correct that row in the repair; Kanon #3709 already owns the general closed-owner freshness guard, so no parallel Thumos mechanism is needed.