ci: check that decisions.md entry pointers resolve

[hakan-persson]

Three stale entry pointers shipped across two PRs, all from renumbering an entry
while a branch was open:

Where	Caught by
aks.bicep comment said entry 11 for what became entry 10 (#9)	by hand, before merge
default.yaml comment said entry 13 for what became entry 14 (#12)	Copilot
decisions.md entry 13 referred to itself instead of entry 12 (#12)	Copilot

Manual sweeps are not working, and the third one shows why. The audit I ran
after the second reported "all 19 resolve" — but it matched only the
decisions.md entry N form that other files use, so it was structurally blind
to the bare entry N form used inside decisions.md itself. It returned a clean
result on an incomplete search, which is worse than not running it.

What the job asserts

Each check corresponds to a failure that has actually happened, or that the same
edit produces:

• Numbering is a gap-free run from 1. A gap is exactly what a rebase leaves
  when another PR claims the number your branch was using — which is how Record why GitOps is ArgoCD, and empty the permissive default AppProject #12 ended
  up needing 12/13 instead of 13/14.
• Every entry has an index row, and every row links to a real anchor.
• Bare entry N references inside decisions.md resolve, and none points at
  the entry containing it. A self-reference sends the reader back where they
  started; that was Copilot's second finding.
• decisions.md entry N references in every other tracked file resolve.

Verified against the failures, not just the happy path

A. self-reference          exit=1  docs/decisions.md:507: entry 13 refers to itself — did a renumber miss this?
B. pointer at entry 99     exit=1  k8s/argocd/projects/default.yaml:3: points at decisions.md entry 99, which does not exist
C. numbering gap           exit=1  entry numbers are not 1..N with no gaps: [1..12, 14]
D. entry with no index row exit=1  docs/decisions.md: entry 13 has no index row
   clean tree              exit=0  13 entries, 37 pointers checked

A job that only passes proves less than one that rejects what it claims to reject.

This is a narrower relative of the doc-refs job written on the #3 branch and
dropped before merge — that one checked file paths and § sections, this one
checks entry numbers. Worth considering whether to bring the other back too, but
that is a separate change.