docs: fix orphan pages and update stale rulesets content

[danielmeppiel]

Problem

Two critical policy documentation pages were sidebar orphans — they existed on disk but were never added to astro.config.mjs, making them invisible to anyone navigating the docs sidebar. Additionally, github-rulesets.md was stale, describing shipped features as "Planned."

Impact

A user navigating the sidebar could find the concept of governance (via governance.md) but not the implementation instructions (ci-policy-setup.md) or the schema reference (policy-reference.md). The policy story had a two-page hole in the middle of its navigation.

Changes

Sidebar fixes (critical)

• Add ci-policy-setup to Guides sidebar — 214-line step-by-step tutorial was unreachable
• Add policy-reference to Enterprise sidebar — 501-line schema reference was unreachable
• Bump agent-workflows sidebar order to 9 (ci-policy-setup takes 8)

Content updates (github-rulesets.md)

• Expand "What It Catches" — was limited to Unicode scanning only; now covers lockfile consistency checks (6 baseline) and policy enforcement checks (16 policy checks)
• Update governance levels table — apm audit --ci and --policy org marked as Available (were incorrectly listed as "Planned" since PR feat(policy): Phase 1 — org-level policy engine for apm audit --ci #365 shipped them)
• Fix "Combining with Other Checks" — update APM audit description from "hidden Unicode scanning" to "content scanning, lockfile verification, and policy enforcement"

Cross-link footers

• Add "Related" sections to ci-policy-setup.md and policy-reference.md for navigational symmetry
• Expand github-rulesets.md "Related" section with links to governance, policy-reference, and ci-policy-setup

Testing

• 3196 unit tests pass
• Documentation-only changes — no code modified

[Copilot]

Pull request overview

Fixes gaps in the Starlight docs sidebar navigation for policy-related pages and refreshes the GitHub Rulesets documentation to reflect the current apm audit --ci / policy capabilities.

Changes:

• Adds previously orphaned pages (ci-policy-setup, policy-reference) to the Starlight sidebar in docs/astro.config.mjs.
• Updates github-rulesets.md to describe baseline vs policy checks and refresh governance level status.
• Adds symmetric cross-links via new "Related" sections in policy setup/reference docs.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
docs/src/content/docs/integrations/github-rulesets.md	Expands/updates Rulesets page content and related links (some --ci behavior details need correction).
docs/src/content/docs/guides/ci-policy-setup.md	Adjusts sidebar ordering and adds a "Related" section for navigation.
docs/src/content/docs/guides/agent-workflows.md	Bumps sidebar order to make room for CI policy guide.
docs/src/content/docs/enterprise/policy-reference.md	Adds a "Related" section to improve navigability.
docs/astro.config.mjs	Registers orphan pages in the Guides/Enterprise sidebars so they appear in navigation.

Comments suppressed due to low confidence (2)

docs/src/content/docs/integrations/github-rulesets.md:75

• The exit code description here doesn't match --ci mode. apm audit --ci exits 0 when clean and 1 if any CI check fails (no exit code 2 for warnings). Since this section is describing --ci/policy checks, please adjust the wording to reflect the --ci exit-code contract (and, if needed, separately document the 0/1/2 behavior for non---ci content scanning).

When issues are detected, the command exits with a non-zero status code (1 = critical, 2 = warnings) and the check fails.

docs/src/content/docs/integrations/github-rulesets.md:66

• The "Lockfile consistency" bullet claims apm audit --ci detects modified files and unresolved dependencies. The baseline CI checks primarily validate lockfile presence, ref/config consistency, orphaned packages, and that deployed files listed in the lockfile exist on disk; they do not verify file contents for modification nor perform dependency resolution. Please tighten this description to match what --ci actually checks today.

- **Lockfile consistency** (`apm audit --ci`) -- verifies installed packages match the lockfile, detects missing or modified files, and checks for unresolved dependencies