What

Adding a not-yet-published GOV.UK URL to a document collection group (/government/admin/collections/:id/groups/:id/add_by_url) fails with "Url must reference a GOV.UK page".

The link validation only queries the live content store, which holds published content only. This was a regression from WHIT-3436 (#11442), which replaced the previous Publishing API lookup (lookup_content_id with with_drafts: true) with the live content store to fix Welsh/locale resolution — but in doing so dropped draft awareness.

How

• Query the live content store first (preserves the WHIT-3436 locale-agnostic fix for published pages, e.g. Welsh).
• Fall back to the draft content store when the live store returns a 404, so unpublished URLs resolve again. The draft store is also locale-agnostic, so it covers Welsh drafts too.
• Only raise "must reference a GOV.UK page" when both stores 404.
• Add Services.draft_content_store, authenticated with a dedicated DRAFT_CONTENT_STORE_BEARER_TOKEN — the draft content store serves non-public content and requires a Signon bearer token (unlike the live store, which Whitehall reads without one).

⚠️ Infra provisioning required before this works in real environments

The code defaults the token to "example" (local dev). Integration/staging/production need a real token provisioning:

• Signon — grant Whitehall's API user access to Draft Content Store and issue an access token, per environment (superadmin task; see Manage Signon accounts).
• govuk-secrets — store the token as DRAFT_CONTENT_STORE_BEARER_TOKEN.
• govuk-helm-charts — inject it into whitehall-admin pods.
• Confirm with platform/publishing whether server-to-server GdsApi::ContentStore reads against draft-content-store return access_limited items, or only non-limited drafts (per the draft stack docs).
• Verify on integration — retry the original failing URL.

Test plan

• On integration (once the token is wired), add an draft statistics URL to a collection group and confirm it succeeds.