CI: add codegen freshness check and unify generation pipelines

[guineveresaenger]

Problem

The repo has two independent generation pipelines that don't cover each other's outputs:

	make codegen	make prep
CRDs	yes	yes (via build-quickstart)
docs/*.md	yes	no
install.yaml	no	yes
version strings	no	yes

This means:

• install.yaml drifts because only make prep regenerates it
• docs/*.md drift because only make codegen regenerates them
• Neither pipeline covers the other's outputs
• There is no CI check that validates generated files are in sync

Current state on master

Running make codegen on master today produces diffs in:

• docs/programs.md — clobbers hand-written Package Management section (see codegen: make generate-crdocs clobbers hand-written content in docs/programs.md #1175)
• docs/workspaces.md — adds missing GitHub App auth docs that feat: add GitHub App authentication for git sources #1167 should have generated

Running make prep produces additional diffs in:

• deploy/quickstart/install.yaml — picks up CRD changes from feat: add --run-program support for destroy and refresh #1171 and docs: clarify ResyncFrequencySeconds and ContinueResyncOnCommitMatch #1176 that were never regenerated

Recent examples

• feat: add --run-program support for destroy and refresh #1171 clobbered hand-written content in docs/programs.md by running make codegen
• docs: clarify ResyncFrequencySeconds and ContinueResyncOnCommitMatch #1176 updated CRD descriptions but didn't regenerate install.yaml
• feat: add GitHub App authentication for git sources #1167 added GitHub App auth but didn't regenerate docs/workspaces.md

Blockers

Before unifying the pipelines or adding a freshness check, #1175 needs to be resolved. make generate-crdocs uses crdoc --output which completely overwrites each docs file, destroying any hand-written content. Until that's fixed, we can't safely run make codegen as part of make prep or CI.

Suggested plan

1. Fix codegen: make generate-crdocs clobbers hand-written content in docs/programs.md #1175 (prevent crdoc from clobbering hand-written docs content)
2. Make make codegen also run make build-deploy (or add a unified make generate-all)
3. Add a CI step: make generate-all && git diff --exit-code