docs: generate action and workflow input/output tables

[ricky-undeadcoders]

Regenerates the Inputs/Outputs tables in every action README and reusable workflow doc from the YAML that declares them, and adds a CI job that fails when they drift.

#1454 added the generator and is now merged; this PR is its output plus the enforcement job. Rebased onto main, so it stands alone.

Titled docs: deliberately: this touches 37 action READMEs, and every action is its own release-please package. A feat: here would minor-bump all 38 for a documentation change.

What this catches

The tables now carry Required and Default generated from the YAML rather than from prose. That immediately surfaced docs that had drifted from their actions:

Action	Was documented as	Actually
cleanup-branches	dry-run defaults to true	defaults to false — the docs implied a no-op by default, for an action that deletes branches
validate-policy-bot-config	policy-bot.grafana.net/api/v1/validate	github-policy-bot.grafana-ops.net/api/validate
reusable-zizmor	min-severity is medium	low
docker-build-push-multiarch	output runner_arches	runner-arches
go-flaky-tests	3 outputs	declares none of them
trigger-argo-workflow	workflow_template "defaults to grafana-ci"	no such default; the input is required

21 of 38 actions had drifted. Around 20 previously undocumented inputs/outputs are now covered, and check-drone-signature gained a doc it never had.

How it works

Generated tables live between <!-- BEGIN_INPUTS --> / <!-- END_INPUTS --> markers. Only the text between markers is replaced, so hand-written prose, footnotes and markdownlint pragmas survive regeneration.

To update after changing an action's YAML:

cd scripts/generate-input-output-docs
go run . generate -root-dir ../../

CI runs the same thing and fails on any diff.

Source YAML changes

A handful of descriptions were corrected or enriched, because the YAML is now the source of truth and the old hand-written tables carried detail it lacked:

• docker-import-digests-push-manifest: image-digests was described as a CSV list. It is emitted one per line — the jq at action.yaml:231 produces "\(.tag)@\(.indexDigest)" per entry as a multiline output. Corrected, and the gating on push/generate-summary documented.
• trigger-argo-workflow: removed the false "defaults to grafana-ci" claim, and fixed an unbalanced quote in extra_args.
• socket-export-sbom: recorded the full-scans:create and report:read scopes the token needs.
• run-capslock, generate-openapi-clients, find-pr-for-commit, push-to-gcs, wait-for-docker-publish, get-latest-workflow-artifact, aws-auth, dependabot-auto-triage, reusable-zizmor: restored enum values, conditional-required nuance and other detail that existed only in the old README prose.

Caught during the rebase

While this sat in review, create-github-app-token was rewritten on main
(#2028, node24 + post-job revocation). That changed its inputs, so its generated
table went stale and the drift check flagged it — regenerated here.

Worth noting the rewrite also set github_app to required: true, which fixes
one of the inaccuracies this work turned up.

Notes for review

• The drift check uses git add -A && git diff --staged --exit-code. Plain git diff would miss a doc the generator had to create from scratch, since new files are untracked — and a brand-new action with no README is exactly the case worth catching. (check-catalog-info.yaml has this bug today; separate issue to follow.)
• Runs on ubuntu-x64-small, matching sign-and-attest.yml.
• Bare <placeholder> text in descriptions is escaped, otherwise the renderer eats it as an HTML tag and <image>:<tag>@<digest> displays as :@.

Part of #1466. Closes #137.

The base branch was changed.